Linux kernel (drivers/infiniband/core): Rdma_join_multicast accepted queue-pair types other than UD and built the

Impact

Rdma_join_multicast accepted queue-pair types other than UD and built the multicast event with an uninitialized qkey, so kernel stack contents leaked into fabric-visible multicast state and non-UD QPs could be attached to multicast groups they have no business joining. That is both an information disclosure and a queue-pair type confusion on the shared fabric.

Who can reach it

Local and unprivileged: reached through the userspace RDMA CM character device - a tenant container holding /dev/infiniband/rdma_cm issues the multicast join (the syzkaller path is ucma_write -> ucma_join_multicast). No hardware RDMA adapter is required if soft-RoCE (rxe) or another software provider is present.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the UD-only multicast restriction (commits ae1149885142 / 48e8e7851dc0). Interim: remove /dev/infiniband/rdma_cm from tenant containers and blacklist rdma_ucm where tenants do not need userspace connection management.

References