Linux kernel hns RoCE: soft lockup when completion events arrive faster than the interrupt handler drains them

CVSS 5.5CVE-2024-43872Firmware, BMC & network fabriccurated

Impact

The hns RoCE driver processed completion event queue entries (CEQEs) entirely inside the interrupt handler with no bound on how many it would handle per interrupt. A workload that generates heavy RDMA completion traffic keeps a CPU core in interrupt context long enough to trigger a soft lockup. On a node whose fabric is shared between tenants, any job able to drive the RNIC hard enough degrades or hangs the host rather than just its own queue pairs, and a locked-up node needs a reboot - which on a GPU node means draining jobs that cannot be checkpointed cheaply. Only affects hosts using HiSilicon hns RoCE NICs; mlx5/ConnectX and Intel fabrics are not involved.

Who can reach it

Local user or tenant job with access to an hns RoCE device (verbs/RDMA access, no special privilege beyond the device) able to submit enough work to generate sustained completion events. No remote authentication path is described in the record.

What to do

Take the stable kernel update that moves CEQE processing into a BH workqueue and caps the number handled per work invocation (three stable branches carry the fix; the record names commits, not release numbers). Applying it means installing a new kernel and rebooting each affected node, so it schedules as a rolling drain and reboot across the fleet. No mitigation other than keeping RDMA completion load low is described.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-43872 https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a86137179032c08 https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b https://git.kernel.org/stable/c/97740304c953ac43aebd24678ae999fe0bc9decf

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.