Linux kernel InfiniBand connection manager drivers/infiniband/core/cma.c and cm.c - cm_work_handler race: A race in the

Impact

A race in the InfiniBand connection-manager work handler. Sending a CM request while other request handlers are still running drives an invalid pointer dereference and panics the node - no account on the target, no authentication step, just frames on the fabric. The fix is two commits, and the second one takes a reference on the cm_id before invoking the callback, which means the underlying defect is a live object being used without a reference held. That is use-after-free shaped, so treating the impact ceiling as 'panic' is the optimistic reading. Either way it is one tenant crashing other tenants' nodes across a shared IB fabric.

Who can reach it

Adjacent network, pre-auth. Any host that can send InfiniBand CM requests to the target - i.e. any node or tenant on the same fabric partition.

What to do

Kernel upgrade or vendor backport of both commits 25ae21a10112875763c18b385624df713a288a05 (RDMA/cma: fix crash in request handlers) and 29963437a48475036353b95ab142bf199adb909e (IB/cm: bump reference count on cm_id before invoking callback) - applying only the first leaves the refcount defect in place. Rolling reboot. The structural control, shared with every other pre-auth RDMA-CM issue in this set, is fabric partitioning: IB P_Keys or RoCE VLAN separation so tenants cannot address each other's connection managers at all, because the CM itself has no authentication to enable.

References