Linux kernel (drivers/infiniband/hw/bnxt_re): Collecting hardware counters writes doorbell-pacing statistics into a

Impact

Collecting hardware counters writes doorbell-pacing statistics into a stats buffer that was never sized for them on adapters outside GenP5/P7, producing an 8-byte slab out-of-bounds write. KASAN caught it as a heap overflow; in practice an unprivileged reader of the counters corrupts neighbouring kernel slab objects on a node shared with other tenants.

Who can reach it

Local and unprivileged: reading the RDMA hardware counters (sysfs hw_counters, or an rdma statistic query) is enough to run the faulty parse. A tenant does not need a device node - counter exposure is wider than /dev/infiniband. Conditional on a Broadcom bnxt_re adapter that reports doorbell pacing while not being a GenP5/P7 part.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the out-of-bound check fix (commits 05c5fcc1869a / c11b9b03ea52). Interim: restrict access to RDMA counter surfaces (sysfs hw_counters, rdma netlink) from tenant namespaces on bnxt_re nodes.

References