Linux kernel (drivers/infiniband/sw/rxe): The soft-RoCE retransmit and ack timers race against queue-pair destruction

Impact

The soft-RoCE retransmit and ack timers race against queue-pair destruction: the QP refcount hits zero while a timer handler is still running and then schedules work on the freed object. That is a refcount underflow and use-after-free reachable without any special hardware.

Who can reach it

Any unprivileged process on a node with the rdma_rxe module loaded - soft-RoCE needs no HCA and is commonly available inside containers that were given RDMA access. The attacker creates a QP, keeps retransmit timers armed by stalling or dropping peer acknowledgements from the network side, and destroys the QP concurrently. A fabric peer can help by withholding acks.

What to do

No fixed version is listed in the record - take the stable kernel carrying 756c93d6df7c (or 3c2ae79fb19d / 5ae9da022ee3) and reboot. Interim: unload and blacklist rdma_rxe on nodes that do not actually need soft-RoCE; this removes the whole attack surface cheaply.

References