Linux kernel (drivers/infiniband/hw/bnxt_re): Building the two-level page list for a large RDMA resource assumes

Impact

Building the two-level page list for a large RDMA resource assumes multiple page-directory pages where the hardware only has one, so past 256K page-list entries the driver writes into memory it does not own. A tenant that asks for a big enough queue or resource turns a normal allocation into kernel heap corruption on a shared node.

Who can reach it

Local: a tenant holding /dev/infiniband/uverbs* on a Broadcom bnxt_re adapter reaches it by creating a non-MR resource large enough to need more than 256K page-list entries (very deep queues / very large mappings). No fabric peer needed. Conditional on bnxt_re hardware.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the Level-2 PBL fix (commits df6fed0a2a1a / de5857fa7bcc). Interim: cap per-tenant RDMA resource limits, or remove /dev/infiniband from containers that do not need native verbs on bnxt_re nodes.

References