Executive Summary

This vulnerability exists in the Linux kernel's RDMA/mana_ib component related to RX steering on RSS QP destruction. When an RSS QP (Receive Side Scaling Queue Pair) is destroyed, the function mana_ib_destroy_qp_rss() removes the RX Work Queue (WQ) objects but fails to disable the vPort RX steering in the firmware. This leaves a stale steering configuration that still points to the destroyed RX objects.

If traffic continues to arrive, for example from a peer virtual machine still transmitting, and the virtual function (VF) interface is brought back up, the firmware may deliver completions using stale Completion Queue (CQ) IDs from the old RX objects. These CQ IDs can be reused by the ethernet driver for new transmit (TX) CQs, causing RX completions to incorrectly land on TX CQs, which can lead to warnings and potential malfunctions.

The fix involves disabling vPort RX steering before destroying RX WQ objects to prevent stale steering configurations. The disable logic was refactored into a shared function mana_disable_vport_rx() to avoid code duplication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the network driver to misroute RX completions to TX completion queues due to stale steering configurations. This misrouting can lead to warnings, errors, or instability in network traffic handling within the system.

In practical terms, this could result in degraded network performance, potential data loss, or unexpected behavior in applications relying on RDMA or DPDK for high-performance networking.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stale RX steering configuration in the firmware after an RSS QP is destroyed, which can cause RX completions to incorrectly land on TX completion queues, leading to warnings in the mana driver.

Detection can be done by monitoring system logs for specific warning messages related to the mana driver, such as:

• WARNING: mana_poll_tx_cq+0x1b8/0x220 [mana] (is_sq == false)
• WARNING: mana_gd_process_eq_events+0x209/0x290 (cq_table lookup fails)

You can use commands like `dmesg | grep mana` or `journalctl -k | grep mana` to search for these warnings in kernel logs.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by disabling vPort RX steering before destroying RX WQ objects in the mana_ib driver.

Immediate mitigation steps include:

• Update the Linux kernel to a version that includes the fix where mana_disable_vport_rx() is called before destroying RX WQ objects.
• Ensure that the ethernet driver's mana_dealloc_queues() function calls the updated common disable function.
• Avoid using mana_fence_rqs() as a workaround since it does not address the issue.

Useful 0 Not Useful 0