6.12-stable patches

added patches:
	dibs-loopback-validate-offset-and-size-in-move_data.patch

diff --git a/queue-6.12/dibs-loopback-validate-offset-and-size-in-move_data.patch b/queue-6.12/dibs-loopback-validate-offset-and-size-in-move_data.patch
new file mode 100644 (file)
index 0000000..7b83fcf
--- /dev/null
+++ b/queue-6.12/dibs-loopback-validate-offset-and-size-in-move_data.patch
@@ -0,0 +1,46 @@
+From 78237e3c0720fcc6eb9b87e90fd70f63eeca886f Mon Sep 17 00:00:00 2001
+From: Dust Li <dust.li@linux.alibaba.com>
+Date: Tue, 7 Jul 2026 15:43:18 +0800
+Subject: dibs: loopback: validate offset and size in move_data()
+
+From: Dust Li <dust.li@linux.alibaba.com>
+
+commit 78237e3c0720fcc6eb9b87e90fd70f63eeca886f upstream.
+
+The loopback move_data() performs a memcpy into the registered DMB
+without checking whether offset + size exceeds the DMB length.  Unlike
+real ISM hardware, which enforces memory region bounds natively, the
+software loopback has no such protection.
+
+A peer-supplied out-of-bounds offset or oversized write would result in
+an OOB write past the allocated kernel buffer.  Add an explicit bounds
+check before the memcpy to reject such requests with -EINVAL.
+
+Fixes: f7a22071dbf3 ("net/smc: implement DMB-related operations of loopback-ism")
+Cc: stable@vger.kernel.org
+Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
+Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
+Reported-by: Baul Lee <baul.lee@xbow.com>
+Link: https://patch.msgid.link/20260707074318.1448662-1-dust.li@linux.alibaba.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+[backport for smc_loopback instead of dibs_loopback]
+Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/smc/smc_loopback.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/smc/smc_loopback.c
++++ b/net/smc/smc_loopback.c
+@@ -245,6 +245,11 @@ static int smc_lo_move_data(struct smcd_
+               read_unlock_bh(&ldev->dmb_ht_lock);
+               return -EINVAL;
+       }
++      if ((u64)offset + size > rmb_node->len) {
++              read_unlock_bh(&ldev->dmb_ht_lock);
++              return -EINVAL;
++      }
++
+       memcpy((char *)rmb_node->cpu_addr + offset, data, size);
+       read_unlock_bh(&ldev->dmb_ht_lock);
+ 

diff --git a/queue-6.12/series b/queue-6.12/series
index 3e0b76193859b7e953466e735c5072b875d9e60d..f4f8064e7b13220ed49fe0b6ac3e7bfc68e12d4d 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -1245,3 +1245,4 @@ kvm-arm64-ensure-level-is-always-initialized-when-relaxing-perms.patch
 kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch
 bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch
 perf-x86-amd-brs-fix-kernel-address-leakage.patch
+dibs-loopback-validate-offset-and-size-in-move_data.patch