CVE-2022-48729

CVE-2022-48729: In the Linux kernel’s InfiniBand hfi1 driver (ipoib), a panic occurs when ipoib send_queue_size is increased above the default. The root cause is a shift calculation that used the ring size instead of the txq item size, leading to a panic trace in hfi1_ipoib_drain_tx_ring and a ch...

CVE-2024-26766 IB/hfi1: Fix sdma.h tx->num_descs off-by-one error

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx-numdescs off-by-one error Unfortunately the commit fd8958efe877 introduced another error causing the descs array to overflow. This reults in further crashes easily reproducible by sendmsg system call...