Linux kernel (drivers/infiniband/hw/mlx5): If the second of the two device-wide shared SRQs fails to allocate, the

Impact

If the second of the two device-wide shared SRQs fails to allocate, the error path frees the first one but still publishes both the freed pointer and an error pointer as the device's shared resources. The lock-free fast path then treats the device as initialised forever, so every later QP creation - by any tenant on that adapter - dereferences freed memory or an error pointer, and teardown double-frees. One transient allocation failure permanently converts the shared mlx5 device into a use-after-free generator for the whole node.

Who can reach it

Needs the shared-SRQ allocation to fail once, which a tenant can push for with memory or device-resource pressure from inside its container. After that the corruption is reached by ordinary ibv_create_qp calls from any container holding /dev/infiniband/uverbs*. mlx5 is the NIC in most GPU clusters, so this is not a niche driver.

What to do

Update to 6.6.140 or later, or a stable kernel carrying a13c2ac4d480 / bc2cf5935b46, and reboot. Interim: none that is real - once the device state is poisoned only a reboot clears it, so patch and drain rather than mitigate.

References