Linux kernel RDS over InfiniBand (FRMR registration before connection establishment): An RDS sendmsg carrying

Impact

An RDS sendmsg carrying RDS_CMSG_RDMA_MAP parses the control message and starts fast-registration memory-region work before the RDMA connection exists, dereferencing a NULL rdma_cm_id to reach its queue pair. The existing guard only checked whether the connection object was present, not whether it had a cm_id. Memory registration executing against a connection that has not been established is registration outside any established security context - and the immediate effect is that an unprivileged tenant crashes the node with one sendmsg.

Who can reach it

Local, unprivileged. One sendmsg with RDS_CMSG_RDMA_MAP on a freshly created outgoing RDS connection.

What to do

Kernel update strengthening the guard in rds_ib_reg_frmr() to check the cm_id. Blacklist rds/rds_rdma - the fastest fix for a module you almost certainly do not need.

References