Linux kernel RDMA core (UVERBS_METHOD_QUERY_GID_TABLE): The GID-table query handler used a user-supplied entry size

Impact

The GID-table query handler used a user-supplied entry size directly as a divisor. Passing zero divides by zero in kernel context and takes the node down. It is a small bug with an outsized operational cost on a GPU cluster: one unprivileged tenant issuing one ioctl kills a machine that may be holding several other tenants' multi-day training jobs, and the checkpointing loss is the real damage, not the crash.

Who can reach it

Local ioctl on /dev/infiniband/uverbs* by any RDMA-capable tenant. Unprivileged, single call, no race.

What to do

Kernel update validating user_entry_size before the division. This is the canonical example of why 'just a DoS' scores differently on shared training infrastructure than on a single-tenant box - prioritise it accordingly when triaging.

References