Linux kernel (drivers/net/ethernet/mellanox/mlx4): Shared receive queue objects are looked up from an asynchronous

Impact

Shared receive queue objects are looked up from an asynchronous event handler under RCU, but nothing frees them with RCU and the handler can run against an SRQ that is only half-constructed or already gone. A tenant that creates and destroys SRQs while events land gets a use-after-free on a kernel object - the memory-corruption primitive is inside RDMA connection state, reachable without host privileges.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on a ConnectX-3 (mlx4) adapter can create and tear down SRQs in a loop while a remote peer on the fabric drives SRQ async events (limit-reached, catastrophic error) against those queues. Requires the mlx4_ib/mlx4_core stack in use; no host root and no VFIO passthrough needed.

What to do

Update to a kernel carrying the fix on your stream. Interim: withhold /dev/infiniband/* from untrusted tenants on mlx4-based nodes, or retire ConnectX-3 hardware from multi-tenant duty.

References