hfi1 SdmaTxreq Corruption

Vulnerability analysis

In the HFI1 InfiniBand driver's user SDMA path, the function that sets up a transmit request with Adaptive Header Generation ignores the return value of the SDMA initialization call. When that initialization fails (for example under memory pressure), the transmit request structure is left uninitialized, but the function returns a success-like value and the caller continues processing the request as though initialization had succeeded. The SDMA engine then operates on the uninitialized structure, which can cause a kernel crash or expose stale slab data. The fix captures the initialization return value and propagates the error to the caller so that request processing is aborted when initialization fails. This path is reachable by local users who have access to the HFI1 character device, which requires Intel Omni-Path fabric hardware to be present on the system.