Executive brief
A condition in the Linux kernel's RDMA (Remote Direct Memory Access) driver for HNS hardware triggers a kernel warning when the driver resets. The warning occurs because the completion queue handler is invoked in direct-polling mode when it should not be, causing unnecessary system warnings that may disrupt operations or monitoring systems.
Technical details
The vulnerability is a logic error in the RDMA/hns driver (drivers/infiniband/hw/hns/hns_roce_main.c) where the check_and_get_armed_cq() function fails to exclude completion queues in direct-polling mode (IB_POLL_DIRECT). Although CQs allocated via ib_alloc_cq() always have a comp_handler callback, direct-polling CQs should never trigger this handler. During driver reset, the handler is incorrectly invoked, triggering a WARN_ONCE() kernel warning. The fix adds an additional condition (hr_cq->ib_cq.poll_ctx != IB_POLL_DIRECT) to the existing comp_handler check, preventing armed CQ processing for direct-polling queues. No privilege escalation or data corruption results from this bug; it is purely a cosmetic warning issue during reset events.
Affected products
- Linux Linux kernel multiple versions affected
Timeline
- 2026-08-28: disclosed
- 2026-05-20: patched: Upstream fix committed