Linux kernel InfiniBand qib driver (user SDMA path, qib_user_sdma_pkt): The user SDMA descriptor path did arithmetic on

Impact

The user SDMA descriptor path did arithmetic on user-supplied buffer sizes without overflow checks, so a tenant could overflow addrlimit or bytes_togo and drive a kernel heap buffer overflow directly from the send path. The qib user SDMA interface is a zero-copy DMA submission channel - the whole point is that userspace hands the adapter descriptors - which makes an integer overflow here a straight route to controlled kernel memory corruption on a shared node.

Who can reach it

Local, unprivileged, via the qib character device on nodes carrying QLogic/Intel TrueScale InfiniBand HCAs. Still relevant because older IB fabrics get recycled into cheap secondary GPU clusters long after the frontier fleet has moved to ConnectX.

What to do

Kernel update adding the overflow checks across the user-controlled arithmetic. If the fleet has no qib hardware, blacklist the ib_qib module - that is a cheap, reboot-free way to remove the surface entirely, and worth doing on any node where the driver is present but the hardware is not.

References