Linux kernel RDS RDMA (memory-region cleanup on cookie copy failure): Once __rds_rdma_map() has handed the

Impact

Once __rds_rdma_map() has handed the scatter-gather list and pinned pages to the transport, ownership has moved - but the error path taken when copying the resulting cookie back to userspace fails would unpin and free them again, while the normal teardown path also frees them. The tenant forces the copy failure by supplying an unmapped destination, so this is an on-demand double free of pinned DMA memory: pages that a device may still be able to address get returned to the allocator and handed to someone else.

Who can reach it

Local, unprivileged. Issue an RDS RDMA map request with a deliberately invalid userspace output pointer.

What to do

Kernel update removing the duplicate unpin/free from the put_user() failure branch. Blacklist rds/rds_rdma if unused.

References