Re: [BUG] libibverbs: ibv_create_qp crashes when recv_cq=NULL (expected EINVAL)

[Leon Romanovsky <leon@kernel.org>]

On Mon, Sep 15, 2025 at 11:44:07AM +0800, Yi Liu wrote:
> Hi RDMA maintainers,
> 
> I would like to report a robustness issue in libibverbs (rdma-core).
> 
> **Environment:**
> - Distro: Ubuntu 22.04 (kernel 6.8.0-65-generic)
> - rdma-core version: 39.0-1
> - libibverbs version: 39.0-1 (package: libibverbs1:amd64)
> - Provider: rxe
> - Reproduced with both gdb and ASan
> 
> **Problem description:**
> When calling `ibv_create_qp()` with `attr.recv_cq = NULL` (while
> qp_type=IBV_QPT_RC),
> the process crashes inside `ibv_icmd_create_qp()` due to an unconditional
> dereference of `attr_ex->recv_cq->handle`.
> Instead of returning `-1` with `errno = EINVAL`, libibverbs causes a
> segmentation fault.

Garbage as an input -> garbage as an output.
It is perfectly valid to crash application if wrong input was provided
to the library.

<...>

> 
> **Security consideration**:
> This is primarily a robustness bug. In environments where applications may be
> driven by untrusted inputs (e.g. fuzzing frameworks, multi-tenant clusters),
> it could be considered a denial-of-service vulnerability.
> Please advise whether this should be treated as CVE-worthy or just a
> robustness fix.

No, there is nothing CVE related here. It is not even a bug.

Thanks

> 
> Thanks for your attention!
> 
> Best regards,
> 
> Yi Liu
>