Linux kernel hfi1: PIO credit-return mmap installs a bad pfn and oopses the node

Impact

hfi1_file_mmap()'s PIO_CRED case adds a byte offset to a struct credit_return *, so the computed address lands 256 KiB or 512 KiB past a 10240-byte allocation whenever the hardware send context index reaches 64 or 128. remap_pfn_range() then installs a frame above MAXPHYADDR and the first user read takes a "Bad pagetable" oops, taking the node and every job on it down. Because low send-context indices give offset zero, it is intermittent - whether a job trips it depends on which context it gets. Correcting only the arithmetic is not enough: dma_mmap_coherent() selects the page with vm_pgoff, which hfi1 sets to 0, so user space receives the wrong credit-return page and send PIO stalls forever. On a shared HPC node with Omni-Path, that is an unprivileged crash or hang reachable by any tenant job that opens a PSM2 endpoint.

Who can reach it

Local user with access to the hfi1 character device on a node with Omni-Path 100 fabric - any tenant or batch job allowed to run MPI/PSM2. No authentication beyond device access, no remote path.

What to do

Pick up a stable kernel containing the fix (commits linked in the record), then drain jobs and reboot each Omni-Path node; a kernel driver fix cannot be applied to a running node. No vendor advisory with a product version is present in the record. As an interim workaround the record shows PSM2_SDMA=2 (send PIO disabled) completing normally while the PIO path hangs - the crash itself happens at endpoint open, so that is not a reliable mitigation.

References

Related entries

• Linux kernel RDMA/ucma: race between concurrent multicast join and leave frees in-use stateCVE-2026-98253 · Linux kernel RDMA/ucma (multicast join/leave serialization)Unscored
• Linux kernel RDS/IB: protocol version mismatch deadlocks the RDS connection workqueuesCVE-2026-98257 · Linux kernel RDS over InfiniBand (rds_ib_cm_connect_complete)Unscored
• Linux kernel RDMA/siw: out-of-bounds write from fragmented DDP/RDMAP header copiesCVE-2026-98323 · Linux kernel RDMA/siw (software iWARP DDP/RDMAP header parsing)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored