CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hns: Fix warning in poll cq direct mode
CQs allocated by iballoccq() always have a comphandler. Though in direct mode this handler is never expected to be called, it is still called when the driver is reset, triggering the following WARNONCE():
Call trace: ibcqcompletiondirect+0x38/0x60 hnsrocecqcompletion+0x54/0x90 (hnsrocehwv2] hnsrocehandledeviceerr+Ox1c8/0x340 [hnsrocehwv2] hnsrocehwv2uninitinstance.constprop.0+0x34/0x70 [hnsrocehwv2] hnsrocehwv2resetnotify+0xc4/0xe0 [hnsrocehwv2] hclgenotifyroceclient+0x60/0xbc [hclge] hclgeresetrebuild+0x48/0x34c [hclge] hclgeresetsubtask+0xcc/0xec [hclge] hclgeresetservicetask+0x80/0x160 [hclge] hclgeservicetask+0x50/0x80 (hclge] processonework+0x1cc/0x4d0 workerthread+0x154/0x414 kthread+0x104/0x144 retfromfork+0x10/0x18
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this warning?
The issue applies to Linux systems using the RDMA HNS RoCE driver with completion queues allocated through ib_alloc_cq() in direct polling mode. The warning is triggered when the driver is reset.
Does an attacker need to invoke the completion handler directly?
No attacker requirements are provided. The described trigger is a driver reset, during which the direct-mode completion handler is called even though it is not expected to run in that mode.
How can administrators identify the issue?
Check kernel logs for a WARN_ONCE call trace beginning with ib_cq_completion_direct and hns_roce_cq_completion, occurring during an HNS RoCE driver or device reset.