+++ /dev/null
-From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001
-From: Jason Gunthorpe <jgg@nvidia.com>
-Date: Mon, 2 Mar 2026 18:22:52 -0400
-Subject: iommu: Do not call drivers for empty gathers
-
-From: Jason Gunthorpe <jgg@nvidia.com>
-
-commit 90c5def10bea574b101b7a520c015ca81742183f upstream.
-
-An empty gather is coded with start=U64_MAX, end=0 and several drivers go
-on to convert that to a size with:
-
- end - start + 1
-
-Which gives 2 for an empty gather. This then causes Weird Stuff to
-happen (for example an UBSAN splat in VT-d) that is hopefully harmless,
-but maybe not.
-
-Prevent drivers from being called right in iommu_iotlb_sync().
-
-Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things
-on these empty gathers.
-
-Further, there are several callers that can trigger empty gathers,
-especially in unusual conditions. For example iommu_map_nosync() will call
-a 0 size unmap on some error paths. Also in VFIO, iommupt and other
-places.
-
-Cc: stable@vger.kernel.org
-Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
-Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
-Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
-Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/linux/iommu.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/include/linux/iommu.h
-+++ b/include/linux/iommu.h
-@@ -526,7 +526,8 @@ static inline void iommu_flush_iotlb_all
- static inline void iommu_iotlb_sync(struct iommu_domain *domain,
- struct iommu_iotlb_gather *iotlb_gather)
- {
-- if (domain->ops->iotlb_sync)
-+ if (domain->ops->iotlb_sync &&
-+ likely(iotlb_gather->start < iotlb_gather->end))
- domain->ops->iotlb_sync(domain, iotlb_gather);
-
- iommu_iotlb_gather_init(iotlb_gather);
bluetooth-smp-derive-legacy-responder-stk-authentication-from-mitm-state.patch
bluetooth-smp-force-responder-mitm-requirements-before-building-the-pairing-response.patch
mips-fix-the-gcc-version-check-for-__multi3-workaround.patch
-iommu-do-not-call-drivers-for-empty-gathers.patch
hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch
drm-ast-dp501-fix-initialization-of-scu2c.patch
usb-serial-io_edgeport-add-support-for-blackbox-ic135a.patch
+++ /dev/null
-From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001
-From: Jason Gunthorpe <jgg@nvidia.com>
-Date: Mon, 2 Mar 2026 18:22:52 -0400
-Subject: iommu: Do not call drivers for empty gathers
-
-From: Jason Gunthorpe <jgg@nvidia.com>
-
-commit 90c5def10bea574b101b7a520c015ca81742183f upstream.
-
-An empty gather is coded with start=U64_MAX, end=0 and several drivers go
-on to convert that to a size with:
-
- end - start + 1
-
-Which gives 2 for an empty gather. This then causes Weird Stuff to
-happen (for example an UBSAN splat in VT-d) that is hopefully harmless,
-but maybe not.
-
-Prevent drivers from being called right in iommu_iotlb_sync().
-
-Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things
-on these empty gathers.
-
-Further, there are several callers that can trigger empty gathers,
-especially in unusual conditions. For example iommu_map_nosync() will call
-a 0 size unmap on some error paths. Also in VFIO, iommupt and other
-places.
-
-Cc: stable@vger.kernel.org
-Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
-Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
-Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
-Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/linux/iommu.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/include/linux/iommu.h
-+++ b/include/linux/iommu.h
-@@ -517,7 +517,8 @@ static inline void iommu_flush_iotlb_all
- static inline void iommu_iotlb_sync(struct iommu_domain *domain,
- struct iommu_iotlb_gather *iotlb_gather)
- {
-- if (domain->ops->iotlb_sync)
-+ if (domain->ops->iotlb_sync &&
-+ likely(iotlb_gather->start < iotlb_gather->end))
- domain->ops->iotlb_sync(domain, iotlb_gather);
-
- iommu_iotlb_gather_init(iotlb_gather);
bluetooth-smp-derive-legacy-responder-stk-authentication-from-mitm-state.patch
bluetooth-smp-force-responder-mitm-requirements-before-building-the-pairing-response.patch
mips-fix-the-gcc-version-check-for-__multi3-workaround.patch
-iommu-do-not-call-drivers-for-empty-gathers.patch
hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch
drm-ast-dp501-fix-initialization-of-scu2c.patch
usb-serial-io_edgeport-add-support-for-blackbox-ic135a.patch
+++ /dev/null
-From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001
-From: Jason Gunthorpe <jgg@nvidia.com>
-Date: Mon, 2 Mar 2026 18:22:52 -0400
-Subject: iommu: Do not call drivers for empty gathers
-
-From: Jason Gunthorpe <jgg@nvidia.com>
-
-commit 90c5def10bea574b101b7a520c015ca81742183f upstream.
-
-An empty gather is coded with start=U64_MAX, end=0 and several drivers go
-on to convert that to a size with:
-
- end - start + 1
-
-Which gives 2 for an empty gather. This then causes Weird Stuff to
-happen (for example an UBSAN splat in VT-d) that is hopefully harmless,
-but maybe not.
-
-Prevent drivers from being called right in iommu_iotlb_sync().
-
-Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things
-on these empty gathers.
-
-Further, there are several callers that can trigger empty gathers,
-especially in unusual conditions. For example iommu_map_nosync() will call
-a 0 size unmap on some error paths. Also in VFIO, iommupt and other
-places.
-
-Cc: stable@vger.kernel.org
-Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
-Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
-Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
-Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/linux/iommu.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/include/linux/iommu.h
-+++ b/include/linux/iommu.h
-@@ -509,7 +509,8 @@ static inline void iommu_flush_iotlb_all
- static inline void iommu_iotlb_sync(struct iommu_domain *domain,
- struct iommu_iotlb_gather *iotlb_gather)
- {
-- if (domain->ops->iotlb_sync)
-+ if (domain->ops->iotlb_sync &&
-+ likely(iotlb_gather->start < iotlb_gather->end))
- domain->ops->iotlb_sync(domain, iotlb_gather);
-
- iommu_iotlb_gather_init(iotlb_gather);
bluetooth-smp-derive-legacy-responder-stk-authentication-from-mitm-state.patch
bluetooth-smp-force-responder-mitm-requirements-before-building-the-pairing-response.patch
mips-fix-the-gcc-version-check-for-__multi3-workaround.patch
-iommu-do-not-call-drivers-for-empty-gathers.patch
hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch
mips-mm-allocate-tlb_vpn-array-atomically.patch
iio-adc-ti-adc161s626-fix-buffer-read-on-big-endian.patch
+++ /dev/null
-From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001
-From: Jason Gunthorpe <jgg@nvidia.com>
-Date: Mon, 2 Mar 2026 18:22:52 -0400
-Subject: iommu: Do not call drivers for empty gathers
-
-From: Jason Gunthorpe <jgg@nvidia.com>
-
-commit 90c5def10bea574b101b7a520c015ca81742183f upstream.
-
-An empty gather is coded with start=U64_MAX, end=0 and several drivers go
-on to convert that to a size with:
-
- end - start + 1
-
-Which gives 2 for an empty gather. This then causes Weird Stuff to
-happen (for example an UBSAN splat in VT-d) that is hopefully harmless,
-but maybe not.
-
-Prevent drivers from being called right in iommu_iotlb_sync().
-
-Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things
-on these empty gathers.
-
-Further, there are several callers that can trigger empty gathers,
-especially in unusual conditions. For example iommu_map_nosync() will call
-a 0 size unmap on some error paths. Also in VFIO, iommupt and other
-places.
-
-Cc: stable@vger.kernel.org
-Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
-Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
-Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
-Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/linux/iommu.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/include/linux/iommu.h
-+++ b/include/linux/iommu.h
-@@ -862,7 +862,8 @@ static inline void iommu_flush_iotlb_all
- static inline void iommu_iotlb_sync(struct iommu_domain *domain,
- struct iommu_iotlb_gather *iotlb_gather)
- {
-- if (domain->ops->iotlb_sync)
-+ if (domain->ops->iotlb_sync &&
-+ likely(iotlb_gather->start < iotlb_gather->end))
- domain->ops->iotlb_sync(domain, iotlb_gather);
-
- iommu_iotlb_gather_init(iotlb_gather);
mips-mm-rewrite-tlb-uniquification-for-the-hidden-bit-feature.patch
mips-sibyte-bring-back-cache-initialisation.patch
mips-fix-the-gcc-version-check-for-__multi3-workaround.patch
-iommu-do-not-call-drivers-for-empty-gathers.patch
hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch
mips-mm-allocate-tlb_vpn-array-atomically.patch
drm-amdgpu-fix-the-idr-allocation-flags.patch
+++ /dev/null
-From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001
-From: Jason Gunthorpe <jgg@nvidia.com>
-Date: Mon, 2 Mar 2026 18:22:52 -0400
-Subject: iommu: Do not call drivers for empty gathers
-
-From: Jason Gunthorpe <jgg@nvidia.com>
-
-commit 90c5def10bea574b101b7a520c015ca81742183f upstream.
-
-An empty gather is coded with start=U64_MAX, end=0 and several drivers go
-on to convert that to a size with:
-
- end - start + 1
-
-Which gives 2 for an empty gather. This then causes Weird Stuff to
-happen (for example an UBSAN splat in VT-d) that is hopefully harmless,
-but maybe not.
-
-Prevent drivers from being called right in iommu_iotlb_sync().
-
-Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things
-on these empty gathers.
-
-Further, there are several callers that can trigger empty gathers,
-especially in unusual conditions. For example iommu_map_nosync() will call
-a 0 size unmap on some error paths. Also in VFIO, iommupt and other
-places.
-
-Cc: stable@vger.kernel.org
-Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
-Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
-Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
-Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/linux/iommu.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/include/linux/iommu.h
-+++ b/include/linux/iommu.h
-@@ -978,7 +978,8 @@ static inline void iommu_flush_iotlb_all
- static inline void iommu_iotlb_sync(struct iommu_domain *domain,
- struct iommu_iotlb_gather *iotlb_gather)
- {
-- if (domain->ops->iotlb_sync)
-+ if (domain->ops->iotlb_sync &&
-+ likely(iotlb_gather->start < iotlb_gather->end))
- domain->ops->iotlb_sync(domain, iotlb_gather);
-
- iommu_iotlb_gather_init(iotlb_gather);
mips-mm-rewrite-tlb-uniquification-for-the-hidden-bit-feature.patch
mips-sibyte-bring-back-cache-initialisation.patch
mips-fix-the-gcc-version-check-for-__multi3-workaround.patch
-iommu-do-not-call-drivers-for-empty-gathers.patch
hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch
mips-mm-allocate-tlb_vpn-array-atomically.patch
x86-kexec-disable-kcov-instrumentation-after-load_segments.patch
+++ /dev/null
-From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001
-From: Jason Gunthorpe <jgg@nvidia.com>
-Date: Mon, 2 Mar 2026 18:22:52 -0400
-Subject: iommu: Do not call drivers for empty gathers
-
-From: Jason Gunthorpe <jgg@nvidia.com>
-
-commit 90c5def10bea574b101b7a520c015ca81742183f upstream.
-
-An empty gather is coded with start=U64_MAX, end=0 and several drivers go
-on to convert that to a size with:
-
- end - start + 1
-
-Which gives 2 for an empty gather. This then causes Weird Stuff to
-happen (for example an UBSAN splat in VT-d) that is hopefully harmless,
-but maybe not.
-
-Prevent drivers from being called right in iommu_iotlb_sync().
-
-Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things
-on these empty gathers.
-
-Further, there are several callers that can trigger empty gathers,
-especially in unusual conditions. For example iommu_map_nosync() will call
-a 0 size unmap on some error paths. Also in VFIO, iommupt and other
-places.
-
-Cc: stable@vger.kernel.org
-Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
-Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
-Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
-Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/linux/iommu.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/include/linux/iommu.h
-+++ b/include/linux/iommu.h
-@@ -979,7 +979,8 @@ static inline void iommu_flush_iotlb_all
- static inline void iommu_iotlb_sync(struct iommu_domain *domain,
- struct iommu_iotlb_gather *iotlb_gather)
- {
-- if (domain->ops->iotlb_sync)
-+ if (domain->ops->iotlb_sync &&
-+ likely(iotlb_gather->start < iotlb_gather->end))
- domain->ops->iotlb_sync(domain, iotlb_gather);
-
- iommu_iotlb_gather_init(iotlb_gather);
mips-mm-rewrite-tlb-uniquification-for-the-hidden-bit-feature.patch
mips-sibyte-bring-back-cache-initialisation.patch
mips-fix-the-gcc-version-check-for-__multi3-workaround.patch
-iommu-do-not-call-drivers-for-empty-gathers.patch
hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch
mips-mm-allocate-tlb_vpn-array-atomically.patch
x86-kexec-disable-kcov-instrumentation-after-load_segments.patch
+++ /dev/null
-From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001
-From: Jason Gunthorpe <jgg@nvidia.com>
-Date: Mon, 2 Mar 2026 18:22:52 -0400
-Subject: iommu: Do not call drivers for empty gathers
-
-From: Jason Gunthorpe <jgg@nvidia.com>
-
-commit 90c5def10bea574b101b7a520c015ca81742183f upstream.
-
-An empty gather is coded with start=U64_MAX, end=0 and several drivers go
-on to convert that to a size with:
-
- end - start + 1
-
-Which gives 2 for an empty gather. This then causes Weird Stuff to
-happen (for example an UBSAN splat in VT-d) that is hopefully harmless,
-but maybe not.
-
-Prevent drivers from being called right in iommu_iotlb_sync().
-
-Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things
-on these empty gathers.
-
-Further, there are several callers that can trigger empty gathers,
-especially in unusual conditions. For example iommu_map_nosync() will call
-a 0 size unmap on some error paths. Also in VFIO, iommupt and other
-places.
-
-Cc: stable@vger.kernel.org
-Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
-Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
-Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
-Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/linux/iommu.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/include/linux/iommu.h
-+++ b/include/linux/iommu.h
-@@ -550,7 +550,8 @@ static inline void iommu_flush_iotlb_all
- static inline void iommu_iotlb_sync(struct iommu_domain *domain,
- struct iommu_iotlb_gather *iotlb_gather)
- {
-- if (domain->ops->iotlb_sync)
-+ if (domain->ops->iotlb_sync &&
-+ likely(iotlb_gather->start < iotlb_gather->end))
- domain->ops->iotlb_sync(domain, iotlb_gather);
-
- iommu_iotlb_gather_init(iotlb_gather);
bluetooth-smp-derive-legacy-responder-stk-authentication-from-mitm-state.patch
bluetooth-smp-force-responder-mitm-requirements-before-building-the-pairing-response.patch
mips-fix-the-gcc-version-check-for-__multi3-workaround.patch
-iommu-do-not-call-drivers-for-empty-gathers.patch
hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch
mips-mm-allocate-tlb_vpn-array-atomically.patch
iio-adc-ti-adc161s626-fix-buffer-read-on-big-endian.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
