Linux kernel RDS over InfiniBand (use outside the initial network namespace): The RDS/IB transport was never written to

Impact

The RDS/IB transport was never written to be namespace-aware, but nothing stopped it being used from a non-initial namespace - so containerised workloads could drive an RDMA transport whose internal state assumes a single global namespace. The fix is the honest one: forbid it outright. For an operator the finding is that RDS/IB reachable from a container was never a supported configuration, and any cluster where tenants can open RDS sockets has been running the transport outside its design envelope.

Who can reach it

Local, unprivileged. Any container able to create an RDS socket over an IB device.

What to do

Kernel update restricting RDS/IB to the init namespace. Blacklist rds_rdma and rds now - it is almost certainly unused on a GPU cluster, and unloading it is immediate.

References