Linux kernel (drivers/infiniband/hw/hfi1): An off-by-one in the SDMA descriptor accounting lets the descriptor array in

Impact

An off-by-one in the SDMA descriptor accounting lets the descriptor array in a transmit request overflow, overwriting the neighbouring fields of the request structure - upstream shows a corrupted header pointer and a general protection fault. A tenant sending ordinary traffic thus corrupts kernel memory and can take the node down or steer a kernel pointer.

Who can reach it

Local and unprivileged: reproducible from the sendmsg syscall over an IPoIB interface backed by hfi1, per the upstream report. Any tenant that can send on an Omni-Path / hfi1 IPoIB interface reaches it; no fabric peer or privileged device node is required. Conditional on hfi1 hardware being present and in use for the data path.

What to do

Update to 4.19.308 / 5.4.270 / 5.10.211 / 5.15.150 / 6.1.80 / 6.3 or later. Interim: if hfi1 is not the production fabric on a node, blacklist the hfi1 module; otherwise drain untrusted tenants from Omni-Path nodes until patched.

References