CVE-2026-98352: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
The client borrows shared CQ credits in the ADDRRESOLVED handler via ibcqpoolget(), before the peer is connected. createcm() can return -ERESTARTSYS from waiteventinterruptibletimeout() without destroying the CM ID. The initconns() and stop-and-destroy paths then call destroyconcqqp() while cq is still NULL (no PUT) and only afterwards rdmadestroyid().
CMA serializes the handler against rdmadestroyid() with handlermutex, but that does not order the GET against destroyconcqqp(). If ADDRRESOLVED has already passed the DESTROYING check, it can take conmutex, GET credits, and then lose the con to kfree. Device unregister later hits WARNON(cq->cqeused) in ibcqpoolcleanup().
Set a per-connection flag under conmutex before CQ/QP teardown so a racing ADDRRESOLVED cannot borrow credits after teardown has begun.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel RDMA RTRS client (rtrs-clt) and establishing RTRS connections can encounter the leak. The issue is tied to connection setup and teardown activity in the RDMA client path.
What condition triggers the problem?
The race requires connection setup to be interrupted while the ADDR_RESOLVED handler is borrowing shared completion-queue credits, before the peer is connected. In particular, create_cm() can return -ERESTARTSYS after an interruptible wait, allowing teardown to race with the handler.
How can administrators recognize that the issue has occurred?
A later RDMA device unregister may emit a WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup(). This indicates completion-queue credits remained in use because they were not returned during the interrupted connection path.
What does the fix change?
The fix sets a per-connection flag under con_mutex before completion-queue and queue-pair teardown begins. This prevents a racing ADDR_RESOLVED handler from borrowing CQ credits after teardown has started.