Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): When the driver runs out of firmware command slots, the work

Impact

When the driver runs out of firmware command slots, the work handler bails out without signalling the waiting task, so that task blocks forever. The mlx5 command interface is the single control path for the NIC, so one wedged caller cascades into hung kernel workers and a NIC whose queues, RDMA objects and interrupt moderation can no longer be reconfigured - a fabric stall for every tenant on the node, cleared only by reboot.

Who can reach it

Requires exhausting the mlx5 firmware command index pool, which a tenant can drive from inside a container holding /dev/infiniband/uverbs* (each verbs/DEVX object creation issues a firmware command) or from a VF assigned into a tenant VM. No host privilege and no fabric access needed; the only precondition is enough concurrent command pressure to make cmd_alloc_index() fail.

What to do

Update to 6.1.125 / 6.6.72 or later on those stable branches, or to 6.9/6.10 and later mainline. Interim controls: rate-limit or cap per-tenant RDMA resource creation, and drop /dev/infiniband/* from containers that do not need verbs.

References