Linux kernel (drivers/infiniband/core): The iWARP connection manager returns work items to a free list while the same

Impact

The iWARP connection manager returns work items to a free list while the same items are still queued on the workqueue, so they get re-initialised under the workqueue's feet. The result is workqueue list corruption and a kernel BUG - a hard panic that takes the whole shared node down and every tenant's job with it. Corrupting kernel list pointers is also a classic escalation primitive, and the CNA rates it network-reachable with no privileges.

Who can reach it

Driven by ordinary connection churn on the fabric: any tenant using rdma_cm, or a remote peer opening and closing iWARP connections quickly, hits it. The upstream reproducer is plain ucmatose stress on an Intel E830 in iWARP mode. Requires iw_cm in use - irdma in iWARP mode, cxgb4, or soft-iWARP siw. Not reachable on pure RoCE/IB paths.

What to do

Update to a stable kernel carrying 38c5b49fffa1 (or eb715133e0ae / a6b9e793e74e) and reboot. Interim: run irdma in RoCE rather than iWARP mode where the fabric allows it, and unload/blacklist siw on nodes that do not need soft-iWARP.

References