Linux kernel (drivers/infiniband/ulp/rtrs): The RTRS server trusts a connecting client to send its session-info message

Impact

The RTRS server trusts a connecting client to send its session-info message only after every connection of the path is up and the path is CONNECTED. A client that sends it early walks the server into a NULL dereference, so any host on the fabric can panic a storage-serving node and take out every tenant it serves.

Who can reach it

Pre-authentication and remote: the info_req exchange is part of RTRS path establishment, so a peer that can reach the server's RDMA listener drives it with a malformed connection sequence. Conditional on rtrs-srv being loaded and listening (RNBD storage backend). No tenant device node required - this is fabric-side.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the path-establishment sanity checks (commits 394b2f4d5e01 / b5d407666446). Interim: firewall or fabric-ACL the RTRS server port so only trusted initiators can reach it, or stop exporting RTRS targets from shared nodes.

References