NVIDIA/Mellanox ConnectX driver (mlx5_ib UMR resource init/cleanup): A failed workqueue allocation during mkey-cache

Impact

A failed workqueue allocation during mkey-cache init caused the UMR queue pair to be destroyed twice, giving a double free and a syzkaller-confirmed use-after-free in ib_destroy_qp_user. The UMR queue pair is the driver's own privileged channel for rewriting memory-key translation tables, so a freed-and-reused UMR QP is a control channel over every tenant's memory keys on that adapter.

Who can reach it

Local. Triggered on the mlx5_ib device initialisation path under memory pressure or interrupted allocation - reachable in practice by a tenant that can drive the node into allocation failure while the RDMA stack is initialising.

What to do

Kernel update removing the duplicate cleanup call in mlx5_ib_stage_post_ib_reg_umr_init(). No workaround.

References