Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/ipoib): Creating an IPoIB PKEY child interface with fewer RX

Impact

Creating an IPoIB PKEY child interface with fewer RX queues than its parent lets the parent's RX channel index run off the end of the child's per-channel stats array on every packet, giving an out-of-bounds access driven by receive traffic. The parent IPoIB device is shared, so the corrupted memory and the resulting crash hit whoever else is using that interface.

Who can reach it

Reachable by anyone who can create an IPoIB child PKEY interface over netlink, i.e. CAP_NET_ADMIN in the namespace that owns the IPoIB parent. In InfiniBand GPU clusters where IPoIB netdevs are handed into tenant containers or pods that also hold NET_ADMIN, this is directly tenant-reachable; otherwise it is operator-only. Requires the mlx5 IPoIB path (ib_ipoib) in use - irrelevant on pure RoCE/Ethernet nodes.

What to do

Boot a kernel with the mlx5e IPoIB validation fix (no fixed-version list published; match the stable commits below to your distro backport). Interim controls: do not grant NET_ADMIN to containers that hold an IPoIB parent netdev, and create PKEY child interfaces yourself with the parent's queue count rather than letting tenants do it.

References