Linux kernel (drivers/infiniband/ulp/srp): The SRP abort handler completes the SCSI command itself, after which the

Impact

The SRP abort handler completes the SCSI command itself, after which the SCSI error handler re-queues or re-finishes the same command - a use-after-free of the command structure. This fires on any aborted SRP command, so a storage timeout caused by fabric congestion (including congestion a noisy tenant creates) corrupts kernel memory on the node that mounts the SRP storage.

Who can reach it

Triggered on the initiator side by any SCSI abort, which means an ordinary command timeout - not only a hostile target. In a shared cluster a tenant that saturates the RDMA fabric can induce those timeouts on nodes using SRP-over-IB storage. Conditional on the ib_srp module being loaded and SRP targets being mounted.

What to do

Update to a stable kernel carrying the srp_abort fix (commits 26788a5b48d9 / b9bdffb3f9aa); the record lists the affected series as 3.1 through 3.7 baselines, so verify your distro backport. Interim: move affected nodes off SRP-over-IB storage, or drain them if SRP timeouts are already being observed.

References