Linux kernel (drivers/infiniband/hw/mlx5): When on-demand-paging translation-table population fails, the UMR path

Impact

When on-demand-paging translation-table population fails, the UMR path returns without running its cleanup: the DMA mapping and buffer leak, and if the shared emergency translation page was in use its global mutex is left permanently locked. Every subsequent memory-region update on that node then blocks forever - the RDMA stack wedges for all tenants on the box, not just the one that hit the failure.

Who can reach it

Requires Mellanox/NVIDIA mlx5 with ODP in use - the standard NIC under most GPU clusters. Triggered from a tenant container holding /dev/infiniband/uverbs* that registers on-demand-paging memory regions and drives the populate failure. The CNA scored it network-reachable with no privileges, reflecting that page-fault population is also driven by remote RDMA traffic against the tenant's ODP regions.

What to do

No fixed version is listed in the record - take the stable kernel carrying ffa85a2c1979 (or 9619909d4869 / 1eae35b37923) and reboot; once the mutex is stuck only a reboot clears it. Interim: disable ODP (do not advertise implicit ODP to tenants) on nodes that do not need it.

References