Linux kernel SoftiWARP receive path (siw_qp_rx, siw_tcp_rx_data header processing): When siw_get_hdr() rejects a header

Impact

When siw_get_hdr() rejects a header with -EINVAL before the receive context has been established, the error path still dereferences qp->rx_fpdu->more_ddp_segs on a NULL rx_fpdu. A remote peer sending a deliberately invalid DDP/MPA header crashes the node. On a shared training node that is one unauthenticated packet evicting every co-resident job.

Who can reach it

Remote, unauthenticated. Any peer that can reach the siw TCP listener.

What to do

Kernel update guarding the more_ddp_segs check on rx_fpdu being present. Same immediate mitigation as the other siw issues: unload the siw module where SoftiWARP is not in use.

References