From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 14:16:40 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=4c61dba192f832c6cb09660ca3c63a98f46b47b5;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: dibs-loopback-validate-offset-and-size-in-move_data.patch --- diff --git a/queue-6.12/dibs-loopback-validate-offset-and-size-in-move_data.patch b/queue-6.12/dibs-loopback-validate-offset-and-size-in-move_data.patch new file mode 100644 index 0000000000..7b83fcfc61 --- /dev/null +++ b/queue-6.12/dibs-loopback-validate-offset-and-size-in-move_data.patch @@ -0,0 +1,46 @@ +From 78237e3c0720fcc6eb9b87e90fd70f63eeca886f Mon Sep 17 00:00:00 2001 +From: Dust Li +Date: Tue, 7 Jul 2026 15:43:18 +0800 +Subject: dibs: loopback: validate offset and size in move_data() + +From: Dust Li + +commit 78237e3c0720fcc6eb9b87e90fd70f63eeca886f upstream. + +The loopback move_data() performs a memcpy into the registered DMB +without checking whether offset + size exceeds the DMB length. Unlike +real ISM hardware, which enforces memory region bounds natively, the +software loopback has no such protection. + +A peer-supplied out-of-bounds offset or oversized write would result in +an OOB write past the allocated kernel buffer. Add an explicit bounds +check before the memcpy to reject such requests with -EINVAL. + +Fixes: f7a22071dbf3 ("net/smc: implement DMB-related operations of loopback-ism") +Cc: stable@vger.kernel.org +Reported-by: Federico Kirschbaum +Signed-off-by: Dust Li +Reported-by: Baul Lee +Link: https://patch.msgid.link/20260707074318.1448662-1-dust.li@linux.alibaba.com +Signed-off-by: Paolo Abeni +[backport for smc_loopback instead of dibs_loopback] +Signed-off-by: Dust Li +Signed-off-by: Greg Kroah-Hartman +--- + net/smc/smc_loopback.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/smc/smc_loopback.c ++++ b/net/smc/smc_loopback.c +@@ -245,6 +245,11 @@ static int smc_lo_move_data(struct smcd_ + read_unlock_bh(&ldev->dmb_ht_lock); + return -EINVAL; + } ++ if ((u64)offset + size > rmb_node->len) { ++ read_unlock_bh(&ldev->dmb_ht_lock); ++ return -EINVAL; ++ } ++ + memcpy((char *)rmb_node->cpu_addr + offset, data, size); + read_unlock_bh(&ldev->dmb_ht_lock); + diff --git a/queue-6.12/series b/queue-6.12/series index 3e0b761938..f4f8064e7b 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1245,3 +1245,4 @@ kvm-arm64-ensure-level-is-always-initialized-when-relaxing-perms.patch kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch perf-x86-amd-brs-fix-kernel-address-leakage.patch +dibs-loopback-validate-offset-and-size-in-move_data.patch