Linux kernel (drivers/infiniband/hw/hns): The completion-queue refcount is not held under a lock, so a CQ asynchronous

Impact

The completion-queue refcount is not held under a lock, so a CQ asynchronous event that lands while the same CQ is being destroyed dereferences freed memory. A tenant that can provoke a CQ error event while tearing the CQ down gets a use-after-free in kernel slab memory shared with the rest of the node.

Who can reach it

Local: a tenant holding /dev/infiniband/uverbs* on a HiSilicon hns_roce adapter creates a CQ, provokes an asynchronous CQ event (for example a CQ overrun), and destroys the CQ concurrently. No fabric peer or root needed. Conditional on hns_roce hardware being the RDMA path on that node.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the xa_lock refcount fix (commits 330c825e66ef / 763780ef0336). Interim: drop /dev/infiniband device nodes from tenant containers on hns_roce nodes.

References