Linux kernel (drivers/infiniband/hw/bnxt_re): A user context could request the write-combine doorbell page repeatedly

Impact

A user context could request the write-combine doorbell page repeatedly and concurrently, although the driver supports exactly one, with no lock protecting the state. Racing requests corrupt the doorbell page index mapping and strand the allocated index when the mmap insert fails - a tenant influencing which doorbell page it or another context ends up mapped to. The CNA scored it scope-changed and rated it 9.3.

Who can reach it

Two threads inside one tenant container holding /dev/infiniband/uverbs* on a Broadcom bnxt_re NIC issuing the WC-page allocation request simultaneously. No fabric peer, no host root.

What to do

No fixed version is listed in the record - take the stable kernel carrying 478c4d24193f (or da406b8b49c1 / 441baa790434) and reboot. Interim: drop /dev/infiniband/* from untrusted containers on bnxt_re nodes.

References