Linux kernel hns_roce: bonding teardown order leaks resources and leaves a stale netdev notifier

Impact

When driver removal and a driver reset race, hns_roce releases its bonding resources in hns_roce_hw_v2_exit() and then reallocates them in hns_roce_register_device(), past the point where they can ever be freed. Besides the memory leak, the leaked netdev notifier callback stays registered and is invoked later from netdev_lower_state_changed(), which the report shows ending in a kernel panic. On a fleet using HiSilicon RoCE NICs for the storage or east-west fabric, that panic lands during exactly the events operators trigger deliberately - a driver reset after a link fault, or an unbind during maintenance - so a routine fabric recovery can drop the node instead of healing it. The record gives no indication that an unprivileged user can drive this; it is a race between administrative and error-recovery paths.

Who can reach it

Not reachable by an unprivileged tenant per the record. It requires driver removal (root, or a package upgrade unbinding the module) to run concurrently with a driver reset, which the hardware or error recovery can raise on its own. Only nodes with HiSilicon hns RoCE devices are affected.

What to do

Update to a kernel with the corrected teardown ordering and reboot the affected nodes; a module reload is not a safe substitute here because the bug is in the unbind path itself. Until then, avoid unbinding or upgrading the hns_roce driver while the fabric is flapping, and schedule module changes when the link is stable. The record lists two stable commits and no vendor-fixed version.

References

Related entries

• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored
• RDMA / RoCE: RoCE and IB RDMA have no cryptographic authentication of the QP connection setup or of subsequentNCVD-0000-005-rdma-roce · RDMA / RoCEUnscored
• NVMe-oF over RDMA: NVMe-over-Fabrics inherits RDMA's lack of authenticationNCVD-0000-006-nvme-of-over-rdma · NVMe-oF over RDMAUnscored