Linux kernel (drivers/infiniband/hw/bnxt_re): The driver keeps scheduling completion handlers for a queue pair after

Impact

The driver keeps scheduling completion handlers for a queue pair after that QP is destroyed, so a poll can run against a completion queue that has already been freed. Upstream captured the resulting panic in bnxt_re_poll_cq. A tenant driving normal destroy-QP / destroy-CQ sequences turns this into a use-after-free on a shared node.

Who can reach it

Local: a tenant holding /dev/infiniband/uverbs* on a Broadcom bnxt_re adapter destroys a QP while its completion queue still has work scheduled, then frees the CQ - the race is reachable entirely through ordinary verbs lifecycle calls. Conditional on bnxt_re hardware.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the completion-flush-before-destroy fix (commits b79a0e71d6e8 / b8500538b8f5). Interim: remove /dev/infiniband device nodes from untrusted tenant containers on bnxt_re nodes.

References