Linux kernel (drivers/infiniband/hw/irdma): If copying the queue-pair response back to userspace fails, irdma's

Impact

If copying the queue-pair response back to userspace fails, irdma's create-QP error path calls destroy, which waits on a completion structure that was never initialized. A tenant that supplies a bad response buffer walks the kernel into a wait on uninitialized memory - an indefinite hang or corruption on a node shared with other tenants.

Who can reach it

Local and unprivileged: a tenant holding /dev/infiniband/uverbs* on an Intel irdma adapter issues create-QP with a udata buffer that cannot be written (unmapped or partially mapped), forcing ib_copy_to_udata to fail. No fabric peer or root needed. Conditional on irdma hardware (E810 / X722 RDMA) being present.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the completion-init fix (commits ac1da7bd224d / af310407f79d). Interim: remove /dev/infiniband device nodes from untrusted tenant containers on irdma nodes.

References