Linux kernel (drivers/infiniband/hw/hfi1): User SDMA requests with multiple payload buffers are read past the declared

Impact

User SDMA requests with multiple payload buffers are read past the declared length of each buffer and the wrong pages are put on the wire, so data the sender never asked to transmit leaves the node. The same fix closes pin-cache races that produce duplicate page pinnings and a window where an entry is removed, the lock dropped, and new pages pinned - stale pinned-page state a tenant can steer.

Who can reach it

Local and unprivileged: a tenant with access to the hfi1 user device submits an SDMA request whose non-tail iovec does not end on a page boundary. No fabric peer or root is needed. Conditional on hfi1 (Omni-Path) hardware and the user SDMA path being exposed to tenants.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the multi-iovec SDMA and mmu_rb fixes (commits 9c4c6512d733 / a2bd706ab635). Interim: remove hfi1 user device nodes from tenant containers, or blacklist hfi1 on nodes where Omni-Path is not the production fabric.

References