Linux kernel (drivers/infiniband/hw/bnxt_re): The driver advertises support for 13 scatter-gather entries per work

Impact

The driver advertises support for 13 scatter-gather entries per work request while its internal WQE structure only holds 6, so a tenant that posts a legal large-SGE send writes past the end of the WQE and corrupts adjacent kernel memory. Reported upstream as traffic failures and system crashes - this is attacker-shaped heap corruption from an ordinary verbs post_send.

Who can reach it

Any tenant container holding /dev/infiniband/uverbs* on a Broadcom Gen P7 bnxt_re adapter can trigger it by posting a send work request with more than 6 SGEs - the count the stack is told is legal. No fabric peer or privilege is required; the overflow happens on the local post path. Only applies where bnxt_re Gen P7 hardware is deployed.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the max-SGE fix (commits 3de1b50f055d / 9a479088e0c8). Interim: remove /dev/infiniband device nodes from tenant containers on bnxt_re Gen P7 nodes, or drain those nodes of untrusted tenants until patched.

References