NVIDIA/Mellanox ConnectX driver (mlx5_ib DEVX subscribe-event unwind): DEVX is the raw device-command escape hatch that

Impact

DEVX is the raw device-command escape hatch that lets a userspace RDMA library drive the adapter directly. The subscribe-event handler linked its event object into the shared subscription list before initialising the fields the error path uses, so a failing eventfd_ctx_fdget() - trivially forced by passing a bad file descriptor - dereferences an unset ev_file and calls the xarray deallocator with an unset key. A tenant chooses when to fail, which makes the unwind path reachable on demand on the interface that speaks directly to adapter firmware.

Who can reach it

Local, unprivileged. A tenant calls the DEVX subscribe-event ioctl with an invalid eventfd.

What to do

Kernel update ordering the initialisation before list insertion and making the xarray deallocation exactly-once. If DEVX is not needed by tenant workloads, restricting it is the sharpest control - but note that some accelerated userspace libraries require it, so check before disabling.

References