Linux kernel (drivers/infiniband/core): Tearing down an iWARP connection frees the rdma_id_private while

Impact

Tearing down an iWARP connection frees the rdma_id_private while connection-manager work is still queued against it, so the CM worker runs on freed memory. That is a use-after-free in kernel connection state driven by ordinary connect/disconnect timing, which gives an attacker a write primitive into reclaimed slab memory shared with every other tenant on the node.

Who can reach it

Reached through the iWARP connection manager, which handles incoming connection requests before any application-level authentication. A peer on the IP/RDMA fabric that connects to a listening rdma_cm endpoint drives iw_conn_req_handler, and racing the local destroy path wins the free. Requires an iWARP-capable path in use (irdma, cxgb4, or the software siw driver); a tenant holding /dev/infiniband/rdma_cm can drive both sides of the race locally.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the iwcm lifetime fix (commits d91d253c87fd / 7f25f296fc9b). Interim: blacklist siw if soft-iWARP is not needed, do not expose /dev/infiniband/rdma_cm to tenants, and restrict which peers may open iWARP connections to the node.

References