Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path): When mapping a dmabuf-backed RDMA memory region fails

Impact

When mapping a dmabuf-backed RDMA memory region fails, the dmabuf is unpinned immediately but the pinned flag is left set, so release unpins it a second time. This is the dmabuf path that GPUDirect RDMA uses to register GPU memory for the NIC - a double-unpin here corrupts the pinning state of buffers that sit between GPU memory and the fabric, exactly the code an operator most wants to be boring.

Who can reach it

Local, low-privileged - a tenant process registering GPU memory for RDMA via dmabuf, able to induce a mapping failure (resource pressure, invalid parameters).

What to do

Upgrade the host kernel to 7.0 or a stable backport (6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6). Rolling reboot of GPU nodes using GPUDirect RDMA over dmabuf.

References