Linux kernel (drivers/infiniband/core): A 32-bit advance counter in the core RDMA block iterator wraps when a single

Impact

A 32-bit advance counter in the core RDMA block iterator wraps when a single scatter-gather entry needs more than 4GB of page-aligned coverage, and the iterator never terminates. Registering one very large memory region spins a CPU inside the kernel forever - a whole-node hang that every co-tenant on the box pays for, and it lives in core code shared by all RDMA drivers.

Who can reach it

Local: any tenant holding /dev/infiniband/uverbs* can register a large, misaligned memory region (the upstream trace is an EFA dmabuf registration with a 3GB SG entry and a 2GB page size) and hang the registering CPU. No fabric peer needed; the bug is in drivers/infiniband/core/verbs.c, so it applies across mlx5, efa, irdma and the rest.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the block-iterator overflow fix (commits 902063a9fea5 / d66c1d4178c2). Interim: cap tenant memory-registration size / locked-memory limits, and drop /dev/infiniband from containers that do not need native verbs.

References