CVE-2022-48694

What it actually does

Incorrect CQ targeting for SW-generated completions of outstanding WRs on SQ after QP enters error state causes ib_drain_sq to block indefinitely with no completion.

Why it matters to the business

Systems using RDMA (including NFS/RDMA and iWARP) can experience prolonged or permanent task hangs, leading to service disruption, worker thread starvation, and forced reboots in Linux environments with high-performance networking.

How an attack unfolds

An attacker with local access triggers QP error states on RDMA devices (for example via crafted RDMA operations or fault injection), then invokes ib_drain_sq or related disconnect paths; the resulting hang blocks xprtiod and sunrpc workers, manifesting as hung_task warnings.

How to fix it

Upgrade the Linux kernel to the commit 14d148401c5202fec3a071e24785481d540b22c3 or later stable releases containing the fix; rebuild and reboot with the corrected irdma and ib_core modules.

How to confirm the fix worked

Confirm kernel git commit or package version contains 14d148401c5202fec3a071e24785481d540b22c3; reproduce ib_drain_sq under QP error conditions and verify completions arrive on the correct CQ without timeout.

Typical attack path

1. Obtain local access or trigger RDMA QP error condition
2. Post work requests on SQ and force QP into error state
3. Invoke ib_drain_sq or RDMA transport close path
4. Observe indefinite block in __ib_drain_sq due to wrong CQ completion
5. Resulting kworker/sunrpc hang causes system-level DoS

How to detect it

Search kernel logs for "INFO: task kworker.*blocked for more than" combined with __ib_drain_sq, ib_drain_sq, rpcrdma_xprt_disconnect, or xprt_autoclose; inspect for repeated schedule_timeout in RDMA drain paths.

• __ib_drain_sq+0xf6/0x170 [ib_core]
• ib_drain_sq+0x66/0x70 [ib_core]
• rpcrdma_xprt_disconnect
• xprt_rdma_close
• xprt_autoclose
• Workqueue: xprtiod xprt_autoclose [sunrpc]

What your security team should do

• Apply the referenced kernel commit immediately on all systems exposing RDMA interfaces
• Prioritize patching servers using NFS/RDMA or iWARP transports
• Monitor for hung_task or kworker/u* blocks related to ib_drain_sq and rpcrdma
• Disable RDMA where not required until patched