NVIDIA/Mellanox ConnectX driver (mlx5_ib completion-queue resize, init_cq_frag_buf): CQ resize initialised the wrong

Impact

CQ resize initialised the wrong buffer. Because get_cqe() always returns entries from the current cq->buf, enlarging a completion queue made the driver write initialisation patterns past the end of the smaller live buffer instead of into the new one - an out-of-bounds write whose length the tenant controls by choosing the resize delta, ending in a kernel panic in the reported case.

Who can reach it

Local, unprivileged. A tenant calls resize_cq with a larger size on an mlx5 device.

What to do

Kernel update making init_cq_frag_buf() address the buffer actually being initialised. No configuration workaround - CQ resize is part of the standard verbs API.

References