erdma CQEvent UAF

Vulnerability analysis

A race condition in the erdma RDMA driver allows a completion queue to be freed while an event queue handler is still using it. When the hardware signals a completion or error event, the handler looks up the target completion queue and processes it without holding a reference; if another thread destroys that same completion queue concurrently, its queue buffer and doorbell records can be freed while the event handler is still accessing them. The fix adds a reference count to each completion queue so that event handlers acquire a reference before touching the queue, and the destroy path removes the queue from the lookup table and waits for all in-flight users to finish before releasing any resources. This bug is reachable by any local user with access to the erdma RDMA device who can create and destroy completion queues, and exploitation requires winning a race between queue destruction and asynchronous event processing.