NVIDIA/Mellanox ConnectX driver (mlx5_ib memory-region page size selection): Mlx5_ib stored the result of its

Impact

Mlx5_ib stored the result of its best-page-size search in an unsigned int. Registering a large physically contiguous region - 4GB, which is entirely ordinary for a GPU training buffer pinned for GPUDirect - makes the driver select a 4GB page size, the variable wraps to zero, and the memory key is built from a bogus page size. A memory key whose page size does not describe the memory it maps is precisely the failure mode that lets an RDMA translation land somewhere other than where the registering tenant intended.

Who can reach it

Local, unprivileged. Any tenant registering a very large contiguous buffer through the normal verbs path - this is triggered by legitimate large-model workloads, not only by attack, which is what makes it likely to be latent in the fleet.

What to do

Kernel update widening the page_size variables to unsigned long across the mlx5_ib MR path. Cannot be worked around by configuration - the trigger is buffer size, which the tenant chooses.

References