Linux kernel Soft-RoCE completer (rdma_rxe, invalid lkey handling in atomic operations): The local key is the RDMA

Impact

The local key is the RDMA access-control token - it is what stops one queue pair touching another's registered memory. Soft-RoCE failed to record the WQE status when a LOCAL_WRITE failed, so an atomic operation submitted with a deliberately wrong lkey walked into a WARN and kernel panic instead of returning a completion error. The reachability is the point: supplying a bad lkey is the most basic thing an attacker probing RDMA isolation does, and on this driver it crashed the node rather than being rejected cleanly.

Who can reach it

Local, unprivileged - a tenant posts an atomic work request with an invalid lkey on a Soft-RoCE device.

What to do

Kernel update returning a CQE error instead of falling through. Blacklist rdma_rxe on nodes with hardware RDMA that do not need software RoCE.

References