Executive brief
The Linux kernel's RDMA soft RoCE driver (rxe) contains a null pointer dereference bug in the queue pair cleanup routine. When socket creation fails during RDMA queue pair initialization, the cleanup code attempts to access the socket pointer without checking if it exists first, causing a kernel crash. This affects systems attempting to mount CIFS shares over RDMA, resulting in mount failures and potential denial of service.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the rxe_qp_do_cleanup() function in drivers/infiniband/sw/rxe/rxe_qp.c. The root cause occurs when socket creation fails in rxe_qp_init_req() during RDMA queue pair creation, but the cleanup code unconditionally attempts to call sk_dst_reset() and access qp->sk->sk without first verifying that qp->sk is non-null. The issue is triggered when mount.cifs attempts to establish an RDMA connection. The fix reorders the cleanup operations to check if qp->sk exists before dereferencing it. No user interaction or special privileges are required—the condition is triggered through standard RDMA/CIFS operations. A patch moving the socket operations inside a null-check guard is available in the Linux stable tree.
Affected products
- Linux Linux kernel 6.1.0-rc5 and earlier versions with RDMA/rxe driver
Timeline
- 2022-11-22: disclosed: Vulnerability reported by Zhang Xiaoxu
- 2022-12-31: patched: Fix merged into Linux stable tree (commit f67376d801499f4fa0838c18c1efcad8840e550d)