Linux kernel RTRS client (rtrs-clt init_conns connection-id bound): When connection setup fails partway through, the

Impact

When connection setup fails partway through, the cleanup loop starts at cid == con_num rather than con_num - 1 and indexes one past the end of the connection array. RTRS is the RDMA transport under RNBD block devices, so this is the block-storage path of an RDMA cluster; the kernel CNA rates it network-reachable and unauthenticated, because a peer that makes connection establishment fail at the right point drives the out-of-bounds access remotely.

Who can reach it

Remote. A server-side peer that fails connection establishment partway through the multi-connection setup.

What to do

Kernel update resetting cid to con_num - 1 before the cleanup loop. If RNBD/RTRS is not in use, keep the modules unloaded.

References