From: Greg Kroah-Hartman Date: Wed, 8 Apr 2026 05:35:06 +0000 (+0200) Subject: drop iommu patch X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=edddf3dac785e9a23977a19cf215064ccb7dcaea;p=thirdparty%2Fkernel%2Fstable-queue.git drop iommu patch --- diff --git a/queue-5.10/iommu-do-not-call-drivers-for-empty-gathers.patch b/queue-5.10/iommu-do-not-call-drivers-for-empty-gathers.patch deleted file mode 100644 index c8c8f56381..0000000000 --- a/queue-5.10/iommu-do-not-call-drivers-for-empty-gathers.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Mon, 2 Mar 2026 18:22:52 -0400 -Subject: iommu: Do not call drivers for empty gathers - -From: Jason Gunthorpe - -commit 90c5def10bea574b101b7a520c015ca81742183f upstream. - -An empty gather is coded with start=U64_MAX, end=0 and several drivers go -on to convert that to a size with: - - end - start + 1 - -Which gives 2 for an empty gather. This then causes Weird Stuff to -happen (for example an UBSAN splat in VT-d) that is hopefully harmless, -but maybe not. - -Prevent drivers from being called right in iommu_iotlb_sync(). - -Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things -on these empty gathers. - -Further, there are several callers that can trigger empty gathers, -especially in unusual conditions. For example iommu_map_nosync() will call -a 0 size unmap on some error paths. Also in VFIO, iommupt and other -places. - -Cc: stable@vger.kernel.org -Reported-by: Janusz Krzysztofik -Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com -Signed-off-by: Jason Gunthorpe -Reviewed-by: Lu Baolu -Reviewed-by: Samiullah Khawaja -Reviewed-by: Robin Murphy -Reviewed-by: Vasant Hegde -Signed-off-by: Joerg Roedel -Signed-off-by: Greg Kroah-Hartman ---- - include/linux/iommu.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/include/linux/iommu.h -+++ b/include/linux/iommu.h -@@ -526,7 +526,8 @@ static inline void iommu_flush_iotlb_all - static inline void iommu_iotlb_sync(struct iommu_domain *domain, - struct iommu_iotlb_gather *iotlb_gather) - { -- if (domain->ops->iotlb_sync) -+ if (domain->ops->iotlb_sync && -+ likely(iotlb_gather->start < iotlb_gather->end)) - domain->ops->iotlb_sync(domain, iotlb_gather); - - iommu_iotlb_gather_init(iotlb_gather); diff --git a/queue-5.10/series b/queue-5.10/series index 3bafbfcce5..dc6707fa92 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -373,7 +373,6 @@ alsa-ctxfi-fix-missing-spdifi1-index-handling.patch bluetooth-smp-derive-legacy-responder-stk-authentication-from-mitm-state.patch bluetooth-smp-force-responder-mitm-requirements-before-building-the-pairing-response.patch mips-fix-the-gcc-version-check-for-__multi3-workaround.patch -iommu-do-not-call-drivers-for-empty-gathers.patch hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch drm-ast-dp501-fix-initialization-of-scu2c.patch usb-serial-io_edgeport-add-support-for-blackbox-ic135a.patch diff --git a/queue-5.15/iommu-do-not-call-drivers-for-empty-gathers.patch b/queue-5.15/iommu-do-not-call-drivers-for-empty-gathers.patch deleted file mode 100644 index 96e8d093fe..0000000000 --- a/queue-5.15/iommu-do-not-call-drivers-for-empty-gathers.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Mon, 2 Mar 2026 18:22:52 -0400 -Subject: iommu: Do not call drivers for empty gathers - -From: Jason Gunthorpe - -commit 90c5def10bea574b101b7a520c015ca81742183f upstream. - -An empty gather is coded with start=U64_MAX, end=0 and several drivers go -on to convert that to a size with: - - end - start + 1 - -Which gives 2 for an empty gather. This then causes Weird Stuff to -happen (for example an UBSAN splat in VT-d) that is hopefully harmless, -but maybe not. - -Prevent drivers from being called right in iommu_iotlb_sync(). - -Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things -on these empty gathers. - -Further, there are several callers that can trigger empty gathers, -especially in unusual conditions. For example iommu_map_nosync() will call -a 0 size unmap on some error paths. Also in VFIO, iommupt and other -places. - -Cc: stable@vger.kernel.org -Reported-by: Janusz Krzysztofik -Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com -Signed-off-by: Jason Gunthorpe -Reviewed-by: Lu Baolu -Reviewed-by: Samiullah Khawaja -Reviewed-by: Robin Murphy -Reviewed-by: Vasant Hegde -Signed-off-by: Joerg Roedel -Signed-off-by: Greg Kroah-Hartman ---- - include/linux/iommu.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/include/linux/iommu.h -+++ b/include/linux/iommu.h -@@ -517,7 +517,8 @@ static inline void iommu_flush_iotlb_all - static inline void iommu_iotlb_sync(struct iommu_domain *domain, - struct iommu_iotlb_gather *iotlb_gather) - { -- if (domain->ops->iotlb_sync) -+ if (domain->ops->iotlb_sync && -+ likely(iotlb_gather->start < iotlb_gather->end)) - domain->ops->iotlb_sync(domain, iotlb_gather); - - iommu_iotlb_gather_init(iotlb_gather); diff --git a/queue-5.15/series b/queue-5.15/series index b5171d3550..2e9892b2d7 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -448,7 +448,6 @@ alsa-ctxfi-fix-missing-spdifi1-index-handling.patch bluetooth-smp-derive-legacy-responder-stk-authentication-from-mitm-state.patch bluetooth-smp-force-responder-mitm-requirements-before-building-the-pairing-response.patch mips-fix-the-gcc-version-check-for-__multi3-workaround.patch -iommu-do-not-call-drivers-for-empty-gathers.patch hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch drm-ast-dp501-fix-initialization-of-scu2c.patch usb-serial-io_edgeport-add-support-for-blackbox-ic135a.patch diff --git a/queue-6.1/iommu-do-not-call-drivers-for-empty-gathers.patch b/queue-6.1/iommu-do-not-call-drivers-for-empty-gathers.patch deleted file mode 100644 index 66d504d11b..0000000000 --- a/queue-6.1/iommu-do-not-call-drivers-for-empty-gathers.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Mon, 2 Mar 2026 18:22:52 -0400 -Subject: iommu: Do not call drivers for empty gathers - -From: Jason Gunthorpe - -commit 90c5def10bea574b101b7a520c015ca81742183f upstream. - -An empty gather is coded with start=U64_MAX, end=0 and several drivers go -on to convert that to a size with: - - end - start + 1 - -Which gives 2 for an empty gather. This then causes Weird Stuff to -happen (for example an UBSAN splat in VT-d) that is hopefully harmless, -but maybe not. - -Prevent drivers from being called right in iommu_iotlb_sync(). - -Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things -on these empty gathers. - -Further, there are several callers that can trigger empty gathers, -especially in unusual conditions. For example iommu_map_nosync() will call -a 0 size unmap on some error paths. Also in VFIO, iommupt and other -places. - -Cc: stable@vger.kernel.org -Reported-by: Janusz Krzysztofik -Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com -Signed-off-by: Jason Gunthorpe -Reviewed-by: Lu Baolu -Reviewed-by: Samiullah Khawaja -Reviewed-by: Robin Murphy -Reviewed-by: Vasant Hegde -Signed-off-by: Joerg Roedel -Signed-off-by: Greg Kroah-Hartman ---- - include/linux/iommu.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/include/linux/iommu.h -+++ b/include/linux/iommu.h -@@ -509,7 +509,8 @@ static inline void iommu_flush_iotlb_all - static inline void iommu_iotlb_sync(struct iommu_domain *domain, - struct iommu_iotlb_gather *iotlb_gather) - { -- if (domain->ops->iotlb_sync) -+ if (domain->ops->iotlb_sync && -+ likely(iotlb_gather->start < iotlb_gather->end)) - domain->ops->iotlb_sync(domain, iotlb_gather); - - iommu_iotlb_gather_init(iotlb_gather); diff --git a/queue-6.1/series b/queue-6.1/series index 98e49a89fd..0b93fbf934 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -204,7 +204,6 @@ alsa-ctxfi-fix-missing-spdifi1-index-handling.patch bluetooth-smp-derive-legacy-responder-stk-authentication-from-mitm-state.patch bluetooth-smp-force-responder-mitm-requirements-before-building-the-pairing-response.patch mips-fix-the-gcc-version-check-for-__multi3-workaround.patch -iommu-do-not-call-drivers-for-empty-gathers.patch hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch mips-mm-allocate-tlb_vpn-array-atomically.patch iio-adc-ti-adc161s626-fix-buffer-read-on-big-endian.patch diff --git a/queue-6.12/iommu-do-not-call-drivers-for-empty-gathers.patch b/queue-6.12/iommu-do-not-call-drivers-for-empty-gathers.patch deleted file mode 100644 index 81c6657bd0..0000000000 --- a/queue-6.12/iommu-do-not-call-drivers-for-empty-gathers.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Mon, 2 Mar 2026 18:22:52 -0400 -Subject: iommu: Do not call drivers for empty gathers - -From: Jason Gunthorpe - -commit 90c5def10bea574b101b7a520c015ca81742183f upstream. - -An empty gather is coded with start=U64_MAX, end=0 and several drivers go -on to convert that to a size with: - - end - start + 1 - -Which gives 2 for an empty gather. This then causes Weird Stuff to -happen (for example an UBSAN splat in VT-d) that is hopefully harmless, -but maybe not. - -Prevent drivers from being called right in iommu_iotlb_sync(). - -Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things -on these empty gathers. - -Further, there are several callers that can trigger empty gathers, -especially in unusual conditions. For example iommu_map_nosync() will call -a 0 size unmap on some error paths. Also in VFIO, iommupt and other -places. - -Cc: stable@vger.kernel.org -Reported-by: Janusz Krzysztofik -Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com -Signed-off-by: Jason Gunthorpe -Reviewed-by: Lu Baolu -Reviewed-by: Samiullah Khawaja -Reviewed-by: Robin Murphy -Reviewed-by: Vasant Hegde -Signed-off-by: Joerg Roedel -Signed-off-by: Greg Kroah-Hartman ---- - include/linux/iommu.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/include/linux/iommu.h -+++ b/include/linux/iommu.h -@@ -862,7 +862,8 @@ static inline void iommu_flush_iotlb_all - static inline void iommu_iotlb_sync(struct iommu_domain *domain, - struct iommu_iotlb_gather *iotlb_gather) - { -- if (domain->ops->iotlb_sync) -+ if (domain->ops->iotlb_sync && -+ likely(iotlb_gather->start < iotlb_gather->end)) - domain->ops->iotlb_sync(domain, iotlb_gather); - - iommu_iotlb_gather_init(iotlb_gather); diff --git a/queue-6.12/series b/queue-6.12/series index 0e167bcf87..916ff29093 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -130,7 +130,6 @@ ksmbd-fix-oob-write-in-query_info-for-compound-requests.patch mips-mm-rewrite-tlb-uniquification-for-the-hidden-bit-feature.patch mips-sibyte-bring-back-cache-initialisation.patch mips-fix-the-gcc-version-check-for-__multi3-workaround.patch -iommu-do-not-call-drivers-for-empty-gathers.patch hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch mips-mm-allocate-tlb_vpn-array-atomically.patch drm-amdgpu-fix-the-idr-allocation-flags.patch diff --git a/queue-6.18/iommu-do-not-call-drivers-for-empty-gathers.patch b/queue-6.18/iommu-do-not-call-drivers-for-empty-gathers.patch deleted file mode 100644 index f8fb79e2e7..0000000000 --- a/queue-6.18/iommu-do-not-call-drivers-for-empty-gathers.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Mon, 2 Mar 2026 18:22:52 -0400 -Subject: iommu: Do not call drivers for empty gathers - -From: Jason Gunthorpe - -commit 90c5def10bea574b101b7a520c015ca81742183f upstream. - -An empty gather is coded with start=U64_MAX, end=0 and several drivers go -on to convert that to a size with: - - end - start + 1 - -Which gives 2 for an empty gather. This then causes Weird Stuff to -happen (for example an UBSAN splat in VT-d) that is hopefully harmless, -but maybe not. - -Prevent drivers from being called right in iommu_iotlb_sync(). - -Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things -on these empty gathers. - -Further, there are several callers that can trigger empty gathers, -especially in unusual conditions. For example iommu_map_nosync() will call -a 0 size unmap on some error paths. Also in VFIO, iommupt and other -places. - -Cc: stable@vger.kernel.org -Reported-by: Janusz Krzysztofik -Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com -Signed-off-by: Jason Gunthorpe -Reviewed-by: Lu Baolu -Reviewed-by: Samiullah Khawaja -Reviewed-by: Robin Murphy -Reviewed-by: Vasant Hegde -Signed-off-by: Joerg Roedel -Signed-off-by: Greg Kroah-Hartman ---- - include/linux/iommu.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/include/linux/iommu.h -+++ b/include/linux/iommu.h -@@ -978,7 +978,8 @@ static inline void iommu_flush_iotlb_all - static inline void iommu_iotlb_sync(struct iommu_domain *domain, - struct iommu_iotlb_gather *iotlb_gather) - { -- if (domain->ops->iotlb_sync) -+ if (domain->ops->iotlb_sync && -+ likely(iotlb_gather->start < iotlb_gather->end)) - domain->ops->iotlb_sync(domain, iotlb_gather); - - iommu_iotlb_gather_init(iotlb_gather); diff --git a/queue-6.18/series b/queue-6.18/series index 365911f471..09a58c3275 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -146,7 +146,6 @@ ksmbd-fix-oob-write-in-query_info-for-compound-requests.patch mips-mm-rewrite-tlb-uniquification-for-the-hidden-bit-feature.patch mips-sibyte-bring-back-cache-initialisation.patch mips-fix-the-gcc-version-check-for-__multi3-workaround.patch -iommu-do-not-call-drivers-for-empty-gathers.patch hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch mips-mm-allocate-tlb_vpn-array-atomically.patch x86-kexec-disable-kcov-instrumentation-after-load_segments.patch diff --git a/queue-6.19/iommu-do-not-call-drivers-for-empty-gathers.patch b/queue-6.19/iommu-do-not-call-drivers-for-empty-gathers.patch deleted file mode 100644 index 86ae89a940..0000000000 --- a/queue-6.19/iommu-do-not-call-drivers-for-empty-gathers.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Mon, 2 Mar 2026 18:22:52 -0400 -Subject: iommu: Do not call drivers for empty gathers - -From: Jason Gunthorpe - -commit 90c5def10bea574b101b7a520c015ca81742183f upstream. - -An empty gather is coded with start=U64_MAX, end=0 and several drivers go -on to convert that to a size with: - - end - start + 1 - -Which gives 2 for an empty gather. This then causes Weird Stuff to -happen (for example an UBSAN splat in VT-d) that is hopefully harmless, -but maybe not. - -Prevent drivers from being called right in iommu_iotlb_sync(). - -Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things -on these empty gathers. - -Further, there are several callers that can trigger empty gathers, -especially in unusual conditions. For example iommu_map_nosync() will call -a 0 size unmap on some error paths. Also in VFIO, iommupt and other -places. - -Cc: stable@vger.kernel.org -Reported-by: Janusz Krzysztofik -Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com -Signed-off-by: Jason Gunthorpe -Reviewed-by: Lu Baolu -Reviewed-by: Samiullah Khawaja -Reviewed-by: Robin Murphy -Reviewed-by: Vasant Hegde -Signed-off-by: Joerg Roedel -Signed-off-by: Greg Kroah-Hartman ---- - include/linux/iommu.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/include/linux/iommu.h -+++ b/include/linux/iommu.h -@@ -979,7 +979,8 @@ static inline void iommu_flush_iotlb_all - static inline void iommu_iotlb_sync(struct iommu_domain *domain, - struct iommu_iotlb_gather *iotlb_gather) - { -- if (domain->ops->iotlb_sync) -+ if (domain->ops->iotlb_sync && -+ likely(iotlb_gather->start < iotlb_gather->end)) - domain->ops->iotlb_sync(domain, iotlb_gather); - - iommu_iotlb_gather_init(iotlb_gather); diff --git a/queue-6.19/series b/queue-6.19/series index d579f71129..1b0a6e014e 100644 --- a/queue-6.19/series +++ b/queue-6.19/series @@ -184,7 +184,6 @@ ksmbd-fix-oob-write-in-query_info-for-compound-requests.patch mips-mm-rewrite-tlb-uniquification-for-the-hidden-bit-feature.patch mips-sibyte-bring-back-cache-initialisation.patch mips-fix-the-gcc-version-check-for-__multi3-workaround.patch -iommu-do-not-call-drivers-for-empty-gathers.patch hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch mips-mm-allocate-tlb_vpn-array-atomically.patch x86-kexec-disable-kcov-instrumentation-after-load_segments.patch diff --git a/queue-6.6/iommu-do-not-call-drivers-for-empty-gathers.patch b/queue-6.6/iommu-do-not-call-drivers-for-empty-gathers.patch deleted file mode 100644 index cb7f0d95be..0000000000 --- a/queue-6.6/iommu-do-not-call-drivers-for-empty-gathers.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 90c5def10bea574b101b7a520c015ca81742183f Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Mon, 2 Mar 2026 18:22:52 -0400 -Subject: iommu: Do not call drivers for empty gathers - -From: Jason Gunthorpe - -commit 90c5def10bea574b101b7a520c015ca81742183f upstream. - -An empty gather is coded with start=U64_MAX, end=0 and several drivers go -on to convert that to a size with: - - end - start + 1 - -Which gives 2 for an empty gather. This then causes Weird Stuff to -happen (for example an UBSAN splat in VT-d) that is hopefully harmless, -but maybe not. - -Prevent drivers from being called right in iommu_iotlb_sync(). - -Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things -on these empty gathers. - -Further, there are several callers that can trigger empty gathers, -especially in unusual conditions. For example iommu_map_nosync() will call -a 0 size unmap on some error paths. Also in VFIO, iommupt and other -places. - -Cc: stable@vger.kernel.org -Reported-by: Janusz Krzysztofik -Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com -Signed-off-by: Jason Gunthorpe -Reviewed-by: Lu Baolu -Reviewed-by: Samiullah Khawaja -Reviewed-by: Robin Murphy -Reviewed-by: Vasant Hegde -Signed-off-by: Joerg Roedel -Signed-off-by: Greg Kroah-Hartman ---- - include/linux/iommu.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/include/linux/iommu.h -+++ b/include/linux/iommu.h -@@ -550,7 +550,8 @@ static inline void iommu_flush_iotlb_all - static inline void iommu_iotlb_sync(struct iommu_domain *domain, - struct iommu_iotlb_gather *iotlb_gather) - { -- if (domain->ops->iotlb_sync) -+ if (domain->ops->iotlb_sync && -+ likely(iotlb_gather->start < iotlb_gather->end)) - domain->ops->iotlb_sync(domain, iotlb_gather); - - iommu_iotlb_gather_init(iotlb_gather); diff --git a/queue-6.6/series b/queue-6.6/series index 912ec199ff..6b25f0a6c4 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -79,7 +79,6 @@ alsa-ctxfi-fix-missing-spdifi1-index-handling.patch bluetooth-smp-derive-legacy-responder-stk-authentication-from-mitm-state.patch bluetooth-smp-force-responder-mitm-requirements-before-building-the-pairing-response.patch mips-fix-the-gcc-version-check-for-__multi3-workaround.patch -iommu-do-not-call-drivers-for-empty-gathers.patch hwmon-occ-fix-division-by-zero-in-occ_show_power_1.patch mips-mm-allocate-tlb_vpn-array-atomically.patch iio-adc-ti-adc161s626-fix-buffer-read-on-big-endian.patch