Linux kernel SRP target drivers/infiniband/ulp/srpt/ib_srpt.c: An SRP initiator that issues an ABORT_TASK against an

Impact

An SRP initiator that issues an ABORT_TASK against an in-flight write dereferences NULL in the target and panics the box. In an InfiniBand cluster the SRP target is the shared block-storage head that many compute nodes mount, so a single tenant sending one malformed SCSI task-management command takes storage away from every job on the fabric simultaneously - the highest-fan-out DoS in an IB cluster. Worth cataloguing because the SRP protocol has no initiator authentication beyond fabric membership: if you are on the fabric, you are an authorized initiator.

Who can reach it

An SRP initiator on the fabric - i.e. any node or tenant permitted to mount SRP LUNs. Authorization is fabric membership, not a credential.

What to do

Kernel upgrade to 4.5.1+ on the storage target nodes, or a vendor backport; requires draining and rebooting the storage head, which for a single-headed SRP target means a storage outage unless the target is clustered. Longer-term control: restrict SRP initiator access with IB partition keys and target-side ACLs so that fabric membership alone does not grant initiator rights.

References