irdma RingMR UAF

Vulnerability analysis

A local user with access to an Intel RDMA device can deregister memory regions that are still backing active QP, CQ, or SRQ ring structures. Because the original code does not hold a reference count on the memory region when it is associated with a ring, the deregistration frees the region's resources while the kernel still references it through the ring, resulting in a use-after-free when the ring subsequently accesses the freed memory. The fix adds a per-MR reference count that is incremented each time the MR is bound to a ring and decremented when that ring is torn down, so the memory region cannot be freed until all rings using it have been released. The vulnerable path is reachable from userspace through the RDMA verbs API on a system with the irdma driver loaded and compatible Intel RDMA hardware present; it requires only ordinary local device access, not root privileges.