Linux kernel - RDMA/rxe memory region translation, drivers/infiniband/sw/rxe/rxe_mr.c: TENANT ISOLATION: rxe mishandles

Impact

TENANT ISOLATION: rxe mishandles memory regions whose page size differs from the system PAGE_SIZE - it steps the page list by mr->page_size while each stored entry actually represents PAGE_SIZE of memory. The result is that an IO virtual address resolves to the wrong physical page, so a legitimate-looking remote access lands on memory outside the intended region. This is the most dangerous shape a memory-registration bug can take: the rkey check passes, the access is authorised, and the data returned or overwritten belongs to something else entirely. It matters concretely on ARM64 GPU hosts (64K pages) and anywhere hugepages are used for RDMA buffers - which is standard practice for training-job memory. A reported kernel panic is the visible symptom; silent cross-region reads and writes are the security consequence.

Who can reach it

A remote peer issues ordinary RDMA reads or writes against a memory region registered with a page size differing from the host PAGE_SIZE. No malformed packets needed - the mistranslation happens in the victim's own code path. Reachability is whatever the rxe endpoint's reachability is; combined with the rkey weaknesses described in the ReDMArk entry, an attacker who guesses into a region gets misdirected access on top of unauthorised access.

What to do

Host reboot / kernel upgrade. Interim: unload and blacklist rdma_rxe if Soft-RoCE is not in deliberate use (config change, no downtime). If rxe is required, avoid registering regions whose page size differs from PAGE_SIZE until patched - in practice that means not backing RDMA buffers with hugepages on affected kernels, which costs performance but is a same-day application/config change. Prioritise ARM64 GPU hosts and any node with 64K pages.

References