Linux kernel Soft-RoCE shared receive queue (rdma_rxe, rxe_srq_from_init): If the copy_to_user() that returns the SRQ

Impact

If the copy_to_user() that returns the SRQ number fails, the queue is freed but the stale pointer is left in srq->rq.queue, and the caller's error path frees it again. A tenant forces the copy to fail by pointing it at an unmapped address - which is entirely under its control - so this is a reliably reachable kernel double free, the classic starting point for heap grooming into privilege escalation on a shared node.

Who can reach it

Local, unprivileged. Create an SRQ on a Soft-RoCE device with a deliberately bad userspace response buffer.

What to do

Kernel update clearing srq->rq.queue after the cleanup. Blacklist rdma_rxe where not needed.

References