Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): When a DMA mapping fails on the multi-packet transmit path, the

Impact

When a DMA mapping fails on the multi-packet transmit path, the error handler tears down an unrelated, still-live mapping from the send queue's FIFO. The NIC then DMAs against an IOVA the kernel considers free - which the IOMMU can hand to a different mapping - so the device writes packet data into memory that now belongs to something else, or the PCI function is thrown into error state and the node loses its fabric link entirely.

Who can reach it

The failure trigger is a DMA mapping failure on the TX hot path, which any tenant can manufacture by putting the node under memory pressure while transmitting - no privilege, no device node, no fabric position required. It was originally observed in a plain stress-test environment, so it is not a theoretical corner. Impact is worst on systems with a strict IOMMU (s390 puts the function in error state; on x86 the freed IOVA can be recycled into another domain's mapping).

What to do

Boot a kernel with the mlx5e MPWQE error-path fix (stable commits below; no fixed-version list published for this ID - match against your distro's mlx5_core backport). No useful interim control: the path is core packet transmit and cannot be disabled without taking the NIC out of service.

References