Linux kernel (net/smc): On hosts using soft-RoCE, the IB device has no DMA device, and the SMC buffer-mapping path

Impact

On hosts using soft-RoCE, the IB device has no DMA device, and the SMC buffer-mapping path dereferences that NULL pointer while setting up the receive/send buffers for an inbound connection. An unauthenticated peer connecting to the node crashes the SMC handshake worker and takes the node down - a remote availability kill with no credentials at all.

Who can reach it

Remote and pre-authentication, conditional on soft-RoCE: the crash is in smc_listen_work -> smc_buf_create -> smcr_buf_map_link, so any peer that opens a connection to an SMC-capable listener triggers it when the selected device is the software RoCE driver (rxe) rather than real hardware. Nodes that run rxe for testing, for CPU-only fallback, or inside VMs are exposed; hardware RoCE paths are not.

What to do

Boot a kernel carrying the fix commits (NULL-checks ibdev->dma_device). Interim: unload/blacklist the rdma_rxe module so soft-RoCE devices are not offered to SMC, or blacklist the smc module on those nodes.

References