Linux kernel (drivers/infiniband/hw/irdma): The page-address copy loop only honoured its bound when the bound was

Impact

The page-address copy loop only honoured its bound when the bound was non-zero, so in the flat (level 0) case it kept writing until it ran out of user DMA blocks - past the end of a fixed four-entry array. A tenant that registers more pages than it declared gets a controlled kernel out-of-bounds write, which is a container-to-host escalation primitive.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Intel E810/irdma node creates a CQ, QP or SRQ declaring a small page count (e.g. req.cq_pages) while supplying a user memory region made of more DMA blocks. Entirely local to the tenant - no fabric peer, no host root.

What to do

Update to a stable kernel carrying 4780f58672ee (or 79a20a8e201a / 9f8f0d2099e3) and reboot. Interim: remove /dev/infiniband/* from untrusted containers on irdma nodes, or blacklist the irdma module where RDMA is not required.

References