IB/hfi1: Fix sdma.h tx->num_descs off-by-one error

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2024-26766
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-04-03 17:15:52 UTC
Updated2026-08-04 11:17:02 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easily reproducible by `sendmsg` system call. [ 1080.836473] general protection fault, probably for non-canonical address 0x400300015528b00a: 0000 [#1] PREEMPT SMP PTI [ 1080.869326] RIP: 0010:hfi1_ipoib_build_ib_tx_headers.constprop.0+0xe1/0x2b0 [hfi1] -- [ 1080.974535] Call Trace: [ 1080.976990] <TASK> [ 1081.021929] hfi1_ipoib_send_dma_common+0x7a/0x2e0 [hfi1] [ 1081.027364] hfi1_ipoib_send_dma_list+0x62/0x270 [hfi1] [ 1081.032633] hfi1_ipoib_send+0x112/0x300 [hfi1] [ 1081.042001] ipoib_start_xmit+0x2a9/0x2d0 [ib_ipoib] [ 1081.046978] dev_hard_start_xmit+0xc4/0x210 -- [ 1081.148347] __sys_sendmsg+0x59/0xa0 crash> ipoib_txreq 0xffff9cfeba229f00 struct ipoib_txreq { txreq = { list = { next = 0xffff9cfeba229f00, prev = 0xffff9cfeba229f00 }, descp = 0xffff9cfeba229f40, coalesce_buf = 0x0, wait = 0xffff9cfea4e69a48, complete = 0xffffffffc0fe0760 <hfi1_ipoib_sdma_complete>, packet_len = 0x46d, tlen = 0x0, num_desc = 0x0, desc_limit = 0x6, next_descq_idx = 0x45c, coalesce_idx = 0x0, flags = 0x0, descs = {{ qw = {0x8024000120dffb00, 0x4} # SDMA_DESC0_FIRST_DESC_FLAG (bit 63) }, { qw = { 0x3800014231b108, 0x4} }, { qw = { 0x310000e4ee0fcf0, 0x8} }, { qw = { 0x3000012e9f8000, 0x8} }, { qw = { 0x59000dfb9d0000, 0x8} }, { qw = { 0x78000e02e40000, 0x8} }} }, sdma_hdr = 0x400300015528b000, <<< invalid pointer in the tx request structure sdma_status = 0x0, SDMA_DESC0_LAST_DESC_FLAG (bit 62) complete = 0x0, priv = 0x0, txq = 0xffff9cfea4e69880, skb = 0xffff9d099809f400 } If an SDMA send consists of exactly 6 descriptors and requires dword padding (in the 7th descriptor), the sdma_txreq descriptor array is not properly expanded and the packet will overflow into the container structure. This results in a panic when the send completion runs. The exact panic varies depending on what elements of the container structure get corrupted. The fix is to use the correct expression in _pad_sdma_tx_descs() to test the need to expand the descriptor array. With this patch the crashes are no longer reproducible and the machine is stable.

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-193

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary5.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected d1c1ee052d25ca23735eea912f843bc7834781b4 115b7f3bc1dce590a6851a2dcf23dc1100c49790 git Not specified
CNA Linux Linux affected 40ac5cb6cbb01afa40881f78b4d2f559fb7065c4 5833024a9856f454a964a198c63a57e59e07baf5 git Not specified
CNA Linux Linux affected 6cf8f3d690bb5ad31ef0f41a6206ecf5a068d179 3f38d22e645e2e994979426ea5a35186102ff3c2 git Not specified
CNA Linux Linux affected bd57756a7e43c7127d0eca1fc5868e705fd0f7ba 47ae64df23ed1318e27bd9844e135a5e1c0e6e39 git Not specified
CNA Linux Linux affected eeaf35f4e3b360162081de5e744cf32d6d1b0091 52dc9a7a573dbf778625a0efca0fca55489f084b git Not specified
CNA Linux Linux affected fd8958efe8779d3db19c9124fce593ce681ac709 a2fef1d81becf4ff60e1a249477464eae3c3bc2a git Not specified
CNA Linux Linux affected fd8958efe8779d3db19c9124fce593ce681ac709 9034a1bec35e9f725315a3bb6002ef39666114d9 git Not specified
CNA Linux Linux affected fd8958efe8779d3db19c9124fce593ce681ac709 e6f57c6881916df39db7d95981a8ad2b9c3458d6 git Not specified
CNA Linux Linux affected 0ef9594936d1f078e8599a1cf683b052df2bec00 git Not specified
CNA Linux Linux affected 4.19.291 4.19.308 semver Not specified
CNA Linux Linux affected 5.4.251 5.4.270 semver Not specified
CNA Linux Linux affected 5.10.188 5.10.211 semver Not specified
CNA Linux Linux affected 5.15.99 5.15.150 semver Not specified
CNA Linux Linux affected 6.1.16 6.1.80 semver Not specified
CNA Linux Linux affected 6.2.3 6.3 semver Not specified
CNA Linux Linux affected 6.3 Not specified
CNA Linux Linux unaffected 6.3 semver Not specified
CNA Linux Linux unaffected 4.19.308 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.270 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.211 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.150 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.80 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.19 6.6.* semver Not specified
CNA Linux Linux unaffected 6.7.7 6.7.* semver Not specified
CNA Linux Linux unaffected 6.8 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
lists.debian.org/debian-lts-announce/2024/06/msg00017.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2024/06/msg00020.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 6000567 Debian Security Update for linux (DSA 5658-1)

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report