Linux kernel (drivers/infiniband/hw/irdma): Queue-depth arithmetic was done in 32 bits, so a tenant passing a huge

Impact

Queue-depth arithmetic was done in 32 bits, so a tenant passing a huge SQ/RQ/SRQ size overflows the calculation and the driver reports success with a silently truncated queue. The queue the hardware and the userspace library then disagree about is a direct route to out-of-bounds work-queue-entry writes.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Intel irdma node calls create_qp/create_srq with a size near U32_MAX. No fabric peer or host root required.

What to do

No fixed version is listed in the record - take the stable kernel carrying 3f08351de5ca (or cbd852f5700e / e37afcb56ae0) and reboot. Interim: remove /dev/infiniband/* from untrusted containers on irdma nodes.

References