Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/lib): Every memory-key allocation carrying a steering-tag hint

Impact

Every memory-key allocation carrying a steering-tag hint leaks a small kernel structure when the key is released. A tenant that registers and deregisters RDMA memory regions in a loop grows the host's kernel slab without bound until the node runs out of memory - a noisy-neighbour path from an unprivileged RDMA workload to an out-of-memory event for every tenant on the box.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* that churns memory-region registration/deregistration on an mlx5 device drives it directly; this is the normal steady-state path, not an error path. Conditional on the mkeys carrying TPH steering-tag hints, which the RDMA stack sets for hinted registrations on supporting hardware.

What to do

Update to a kernel carrying the fix on your stream. Interim: cap tenant RDMA registration rates where possible, monitor kernel slab growth on nodes exporting verbs to tenants, and withhold /dev/infiniband/* from workloads that do not need it.

References