Linux kernel i2c-mlxbf (BlueField DPU I2C/SMBus controller): memcpy() is called in a loop with no upper bound

Impact

memcpy() is called in a loop with no upper bound on the operation length while the index keeps incrementing - a kernel stack overflow on the BlueField DPU itself. The DPU Arm cores run your infrastructure services (telemetry, storage emulation, security agents) alongside tenant-facing datapaths, so stack corruption there is compromise of the control point you deployed the DPU to be.

Who can reach it

Local on the DPU Arm side - a process with access to the SMBus/I2C interface. Relevant when tenants or third-party agents get any foothold on the DPU OS.

What to do

Upgrade the DPU Arm-side kernel: 6.0 or a stable backport (5.10.146, 5.15.71, 5.19.12). In practice this arrives as a BFB bundle re-image or a DOCA/BFOS package upgrade on the DPU, followed by a DPU reset - which drops the host's network and storage while it reboots. Plan it as a per-node maintenance window, not a live update.

References