NVIDIA/Mellanox ConnectX driver (mlx5_ib ODP invalidation vs MR deregistration race): During deregistration the lkey is

Impact

During deregistration the lkey is revoked in hardware first, but mlx5_ib_invalidate_range() can concurrently post a UMR update for that same freed lkey. The window is a race between a tenant tearing down a memory region and the MMU notifier invalidating a range of it - two paths the tenant drives - operating on a key the hardware has already released. Keys being operated on after revocation is exactly the state in which a stale key can be observed doing work it should no longer be able to do.

Who can reach it

Local, unprivileged. Concurrent munmap/deregistration of an ODP memory region by a tenant process.

What to do

Kernel update serialising revocation against invalidation. No configuration mitigation.

References