Linux kernel (drivers/infiniband/sw/rxe): If soft-RoCE queue-pair creation fails partway, the unwind path runs cleanup

Impact

If soft-RoCE queue-pair creation fails partway, the unwind path runs cleanup on task state that was never initialized and oopses on an uninitialized spinlock. A tenant that submits a create-QP that is guaranteed to fail can panic the node at will - a repeatable noisy-neighbour outage for everyone sharing it.

Who can reach it

Local and unprivileged: a tenant holding /dev/infiniband/uverbs* on an rdma_rxe (soft-RoCE) device issues a create-QP with parameters that fail after partial initialization. No hardware adapter and no fabric peer needed - rxe runs over any Ethernet NIC. Conditional on the rdma_rxe module being loaded and an rxe device present.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the rxe cleanup-task fix (commits 3236221bb8e4 / c8473cd5b301). Interim: blacklist rdma_rxe on nodes that do not need soft-RoCE, and remove /dev/infiniband from tenant containers.

References