Linux kernel (drivers/infiniband/hw/irdma): A stale flag caused the CQ memory-registration path to read one element

Impact

A stale flag caused the CQ memory-registration path to read one element past the end of the page-address array on current-generation hardware, and to program whatever it read as the CQ shadow DMA address. That is both a kernel out-of-bounds read and an adapter pointed at an address derived from adjacent heap contents.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Intel irdma node registers CQ memory where the declared page count equals the region's page count - the normal case, not a crafted one. Local to the tenant; no fabric peer needed.

What to do

No fixed version is listed in the record - take the stable kernel carrying a80b3b13786e (or 3159c6fac43d / ad360a31092a) and reboot. Interim: drop /dev/infiniband/* from untrusted containers on irdma nodes.

References