Linux kernel Soft-RoCE completion queue (rdma_rxe, rxe_cq_cleanup on create failure): Syzkaller-found slab

Impact

Syzkaller-found slab use-after-free reached straight from ib_uverbs_create_cq - the error unwind in rxe_create_cq() cleans up a queue that has already been released. Reachable by a tenant simply asking for a completion queue it knows will fail to allocate, which makes it easy to trigger repeatedly and therefore easy to shape the heap around.

Who can reach it

Local, unprivileged, via the uverbs create-CQ command on a Soft-RoCE device.

What to do

Kernel update fixing the cleanup ordering. Blacklist rdma_rxe where software RoCE is not in use.

References