kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Jason Gunthorpe dee2a49ade RDMA/umem: Fix truncation for block sizes >= 4G 
[ Upstream commit 15fe76e236 ]

When the iommu is used the linearization of the mapping can give a single
block that is very large split across multiple SG entries.

When __rdma_block_iter_next() reassembles the split SG entries it is
overflowing the 32 bit stack values and computed the wrong DMA addresses
for blocks after the truncation.

Use the right types to hold DMA addresses.

Link: https://patch.msgid.link/r/1-v1-88303e9e509f+f7-ib_umem_types_jgg@nvidia.com
Cc: stable@vger.kernel.org
Fixes: a808273a49 ("RDMA/verbs: Add a DMA iterator to return aligned contiguous memory blocks")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-06-19 13:33:49 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-16 13:39:11 +02:00
acpi ACPI: video: force native backlight on HP OMEN 16 (8A44) 2026-06-01 17:35:19 +02:00
amba amba: tegra-ahb: Fix device leak on SMMU enable 2026-01-19 13:09:54 +01:00
android binder: don't use %pK through printk 2026-03-04 07:20:16 -05:00
ata ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 2026-06-01 17:35:01 +02:00
atm atm: fore200e: fix use-after-free in tasklets during device removal 2026-03-04 07:20:36 -05:00
auxdisplay auxdisplay: arm-charlcd: fix release_mem_region() size 2026-03-04 07:19:20 -05:00
base pmdomain: core: Fix detach procedure for virtual devices in genpd 2026-06-19 13:33:44 +02:00
bcma Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
block use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
bluetooth Bluetooth: hci_qca: Convert timeout from jiffies to ms 2026-06-19 13:33:45 +02:00
bus fsl-mc: Use driver_set_override() instead of open-coding 2026-06-01 17:35:05 +02:00
cdrom cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() 2026-06-01 17:35:41 +02:00
char use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
clk clk: qcom: dispcc-sc7180: Add missing MDSS resets 2026-06-01 17:35:37 +02:00
clocksource clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF 2026-03-04 07:20:00 -05:00
comedi comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() 2026-06-19 13:33:29 +02:00
connector net/connector: Add const qualifier to cb_id 2020-12-16 11:06:49 -08:00
counter counter: interrupt-cnt: Drop IRQF_NO_THREAD flag 2026-01-19 13:10:18 +01:00
cpufreq cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path 2026-06-01 17:35:11 +02:00
cpuidle cpuidle: powerpc: avoid double clear when breaking snooze 2026-06-01 17:35:22 +02:00
crypto crypto: caam - guard HMAC key hex dumps in hash_digest_key 2026-06-19 13:33:42 +02:00
cxl cxl/mem: Fix shutdown order 2023-11-20 11:08:27 +01:00
dax dax/kmem: Pass valid argument to memory_group_register_static 2023-07-23 13:47:17 +02:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() 2025-08-28 16:24:17 +02:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:14:27 +01:00
dma dmaengine: idxd: Fix not releasing workqueue on .release() 2026-06-19 13:33:22 +02:00
dma-buf dma-buf: insert memory barrier before updating num_fences 2025-09-09 18:50:23 +02:00
edac EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() 2026-03-04 07:19:27 -05:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: ptn5150: handle pending IRQ events during system resume 2026-06-01 17:35:22 +02:00
firewire firewire: nosy: Fix dma_free_coherent() size 2026-01-19 13:09:57 +01:00
firmware firmware: arm_ffa: Skip free_pages on RX buffer alloc failure 2026-06-01 17:35:49 +02:00
fpga fpga: dfl: use subsys_initcall to allow built-in drivers to be added 2026-03-04 07:20:25 -05:00
fsi use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpio: rockchip: convert bank->clk to devm_clk_get_enabled() 2026-06-19 13:33:24 +02:00
gpu drm/hyperv: validate resolution_count and fix WIN8 fallback 2026-06-19 13:33:48 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-07-05 09:14:23 +02:00
hid HID: core: Fix size_t specifier in hid_report_raw_event() 2026-06-19 13:33:32 +02:00
hsi HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition 2025-05-02 07:44:06 +02:00
hv Drivers: hv: vmbus: Add utility function for querying ring size 2025-07-10 15:57:36 +02:00
hwmon hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors 2026-06-01 17:35:49 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-12 11:07:41 +02:00
hwtracing coresight: etm3x: Fix cpulocked warning on cpuhp 2026-03-04 07:19:46 -05:00
i2c i2c: tegra: Fix NOIRQ suspend/resume 2026-06-19 13:33:38 +02:00
i3c i3c: mipi-i3c-hci: fix IBI payload length calculation for final status 2026-06-01 17:35:35 +02:00
idle intel_idle: Allow loading ACPI tables for any family 2025-08-28 16:24:16 +02:00
iio iio: dac: ad5686: fix ref bit initialization for single-channel parts 2026-06-19 13:33:47 +02:00
infiniband RDMA/umem: Fix truncation for block sizes >= 4G 2026-06-19 13:33:49 +02:00
input Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard 2026-06-19 13:33:38 +02:00
interconnect interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node 2025-08-28 16:24:03 +02:00
iommu iommu, debugobjects: avoid gcc-16.1 section mismatch warnings 2026-06-19 13:33:28 +02:00
ipack ipack: ipoctal: fix module reference leak 2021-09-27 17:38:49 +02:00
irqchip irqchip/ath79-cpu: Remove unused function 2026-06-01 17:35:50 +02:00
isdn use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
leds leds: lgm-sso: Remove duplicate assignments for priv->mmap 2026-06-01 17:35:35 +02:00
macintosh macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse 2026-01-19 13:09:28 +01:00
mailbox mailbox: mailbox-test: make data_ready a per-instance variable 2026-06-01 17:35:41 +02:00
mcb mcb: fix a double free bug in chameleon_parse_gdd() 2025-05-02 07:44:31 +02:00
md dm cache policy smq: check allocation under invalidate lock 2026-06-19 13:33:33 +02:00
media media: rc: igorplugusb: heed coherency rules 2026-06-19 13:33:41 +02:00
memory memory: tegra30-emc: Fix dll_change check 2026-06-01 17:35:33 +02:00
memstick memstick: Add timeout to prevent indefinite waiting 2025-12-07 06:09:16 +09:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:51:02 +01:00
mfd mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() 2026-06-01 17:35:36 +02:00
misc use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
mmc mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration 2026-06-19 13:33:42 +02:00
most most: usb: fix double free on late probe failure 2025-12-07 06:09:35 +09:00
mtd mtd: spi-nor: sst: Fix write enable before AAI sequence 2026-06-19 13:33:42 +02:00
mux mux: gpio: Simplify code by using dev_err_probe() 2021-04-02 16:28:53 +02:00
net hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf 2026-06-19 13:33:49 +02:00
nfc nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems 2026-06-19 13:33:22 +02:00
ntb NTB: ntb_transport: Fix too small buffer for debugfs_name 2026-03-04 07:20:37 -05:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:25:05 +01:00
nvdimm nvdimm/bus: Fix potential use after free in asynchronous initialization 2026-04-18 10:33:17 +02:00
nvme use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
nvmem nvmem: core: improve range check for nvmem_cell_write() 2025-03-13 12:50:32 +01:00
of device property: Make modifications of fwnode "flags" thread safe 2026-06-01 17:35:13 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:21:23 -04:00
parisc parisc: Fix IRQ leak in LASI driver 2026-06-01 17:35:21 +02:00
parport parport: Fix race between port and client registration 2026-06-19 13:33:26 +02:00
pci PCI: tegra194: Disable direct speed change for Endpoint mode 2026-06-01 17:35:32 +02:00
pcmcia PCMCIA: Fix garbled log messages for KERN_CONT 2026-06-01 17:35:37 +02:00
perf perf: arm_spe: Prevent overflow in PERF_IDX2OFF() 2025-10-19 16:21:29 +02:00
phy phy: tegra: xusb: Fix per-pad high-speed termination calibration 2026-06-19 13:33:47 +02:00
pinctrl pinctrl: abx500: Fix type of 'argument' variable 2026-06-01 17:35:35 +02:00
platform platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL 2026-06-01 17:35:51 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-23 08:54:38 +01:00
power power: supply: max17042: avoid overflow when determining health 2026-06-01 17:35:23 +02:00
powercap powercap: fix sscanf() error return value handling 2026-01-19 13:10:19 +01:00
pps pps: fix warning in pps_register_cdev when register device fail 2025-10-19 16:21:33 +02:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. 2026-02-06 16:41:51 +01:00
pwm pwm: stm32: Always program polarity 2026-01-19 13:10:12 +01:00
rapidio rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() 2026-03-04 07:20:32 -05:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-07 11:52:26 +02:00
regulator regulator: bd9571mwv: fix OF node reference imbalance 2026-06-01 17:35:25 +02:00
remoteproc remoteproc: mediatek: Unprepare SCP clock during system suspend 2026-04-18 10:33:11 +02:00
reset reset: brcmstb: Enable reset drivers for ARCH_BCM2835 2025-08-28 16:24:18 +02:00
rpmsg rpmsg: core: fix race in driver_override_show() and use core helper 2026-03-04 07:20:25 -05:00
rtc rtc: abx80x: Disable alarm feature if no interrupt attached 2026-06-01 17:35:40 +02:00
s390 Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" 2026-06-01 17:35:46 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2025-01-09 13:28:34 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-26 09:24:36 +01:00
slimbus slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock 2026-06-19 13:33:39 +02:00
soc soc: qcom: aoss: compare against normalized cooling state 2026-06-01 17:35:34 +02:00
soundwire soundwire: stream: restore params when prepare ports fail 2025-08-28 16:24:10 +02:00
spi spi: qup: fix error pointer deref after DMA setup failure 2026-06-19 13:33:47 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-07-05 09:14:20 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-09-04 13:23:20 +02:00
staging HID: pass the buffer size to hid_report_raw_event 2026-06-19 13:33:31 +02:00
target scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() 2026-06-19 13:33:49 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: prevent use-after-free when the client exits before the supplicant 2026-06-19 13:33:32 +02:00
thermal thermal: core: Fix thermal zone governor cleanup issues 2026-06-19 13:33:40 +02:00
thunderbolt thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() 2026-06-19 13:33:48 +02:00
tty serial: qcom-geni: fix UART_RX_PAR_EN bit position 2026-06-19 13:33:48 +02:00
uio uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe 2026-01-19 13:09:23 +01:00
usb usb: typec: ucsi: Check if power role change actually happened before handling 2026-06-19 13:33:48 +02:00
vdpa vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check 2026-06-01 17:35:11 +02:00
vfio vfio/type1: Fix error unwind in migration dirty bitmap allocation 2025-06-27 11:05:13 +01:00
vhost use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
video fbcon: Avoid OOB font access if console rotation fails 2026-06-19 13:33:44 +02:00
virt minmax: add in_range() macro 2025-10-19 16:21:28 +02:00
virtio mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() 2026-01-19 13:10:10 +01:00
visorbus visorbus: fix error return code in visorchipset_init() 2021-06-04 15:27:26 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
vme vme: Fix error not catched in fake_init() 2022-12-31 13:14:30 +01:00
w1 w1: therm: Fix off-by-one buffer overflow in alarms_store 2026-02-06 16:42:02 +01:00
watchdog fix it87_wdt early reboot by reporting running timer 2026-03-04 07:20:16 -05:00
xen use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
zorro zorro: Drop useless (and hardly used) .driver member in struct zorro_dev 2021-08-05 14:37:04 +02:00
Kconfig firmware: include drivers/firmware/Kconfig unconditionally 2021-10-07 16:51:26 +02:00
Makefile virtio: always enter drivers/virtio/ 2021-12-22 09:32:39 +01:00