Linux kernel Soft-RoCE mmap path (rdma_rxe, rxe_mmap vs concurrent DESTROY_CQ): Rxe_mmap() removes the mmap-info object

Impact

Rxe_mmap() removes the mmap-info object from the pending list and drops the lock while its kref is still 1, then calls remap_vmalloc_range(), which walks page tables with no lock held. A concurrent DESTROY_CQ ioctl on another CPU drops the last reference, vfree()s the object mid-walk and frees the tracking struct. The tenant controls both threads, so this is a deterministic-enough race giving a use-after-free plus page-table manipulation on memory being torn down - the strongest primitive class in this driver.

Who can reach it

Local, unprivileged. One tenant thread mmaps a Soft-RoCE completion queue while another destroys it.

What to do

Kernel update holding the reference across the remap. Blacklist rdma_rxe where software RoCE is not needed.

References