Linux kernel (drivers/infiniband/ulp/rtrs): The RTRS server builds an RDMA work request around a scatter-gather list

Impact

The RTRS server builds an RDMA work request around a scatter-gather list whose storage has already gone out of scope, so the transport copies data through a dangling descriptor. Upstream saw it as a kernel NULL-pointer fault inside the memory-copy path on the server - a remote client can crash the storage-serving node, and the underlying stale descriptor is a corruption primitive, not just a panic.

Who can reach it

Server-side and driven by the fabric: a client that establishes an RTRS/RNBD session and issues I/O drives the affected path on the target node, before any application-level trust decision. Conditional on the rtrs-srv module being loaded and exporting block devices (RNBD storage backend); the reported trace runs over soft-RoCE (rdma_rxe), which makes it reachable without special hardware.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the ib_sge scope fix (commits 7eaa71f56a6f / 143378075904). Interim: stop exporting RNBD/RTRS targets from shared nodes, or restrict which fabric addresses may open RTRS sessions.

References