Linux kernel (drivers/infiniband/hw/irdma): A tenant that asks for a user QP while declaring a zero-size work-queue

Impact

A tenant that asks for a user QP while declaring a zero-size work-queue buffer leaves a pointer unpopulated that the driver then dereferences unconditionally. The kernel takes a NULL dereference in a syscall path, which oopses the task and, in the wrong context, brings the node down - a noisy-neighbour outage for every other tenant sharing the box.

Who can reach it

One ibv_create_qp call with user_wqe_bufs set to zero from any container holding /dev/infiniband/uverbs* on an Intel irdma node. Trivially reachable, no fabric peer, no privilege beyond the device node.

What to do

No fixed version is listed in the record - take the stable kernel carrying ec675b4cdfd3 (or 728211c815f6 / b9b0889071569) and reboot. Interim: remove /dev/infiniband/* from untrusted containers on irdma nodes.

References