Linux kernel SoftiWARP transmit path (siw_qp_tx, siw_tcp_sendpages byte accounting): After do_tcp_sendpages() was

Impact

After do_tcp_sendpages() was inlined, the sendmsg byte count passed for each page no longer matched the bvec length actually set up, so the transmit path pushed the wrong number of bytes per page. Wrong-length sends on a zero-copy RDMA transmit path mean bytes adjacent to the intended payload go onto the wire, and the stream desynchronises against what the peer expects. The kernel CNA scores it network-reachable with full confidentiality and integrity impact.

Who can reach it

Remote-facing. The corruption occurs on data leaving the node over an established SoftiWARP connection, so a peer that can induce the pathological send pattern observes the extra bytes.

What to do

Kernel update correcting the byte count in siw_tcp_sendpages(). Unload siw where it is not required.

References