From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2EA7935AC10 for ; Thu, 28 May 2026 07:54:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779954855; cv=none; b=cfVbyOIooWxPr3qgj0HfOeRKXmBORhreRKPVv+J/WQvOQLoCVrfcVymegptdvku3Ty7Rth+hkLRwgc21QO0hgBAB8sC3E+LwgeARt+aj3sxvqPJSUas54QlAZA+W7jDm/kQS8mKtY0jOVvfwfdLHMJ5sAe6u976B1yzI10cl7rI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779954855; c=relaxed/simple; bh=XZfLPwvPEs7rpeqbHm+DBZ4q5Ff7z/QbaGovBnsIQOA=; h=Subject:To:Cc:From:Date:Message-ID:MIME-Version:Content-Type; b=ikMg+uYRs4Y2ko/K5oxZY6UwAGXz7gjWCv9tu3wR9G2NpISLn6LfCcLziXrFsTfiFlVNTbWjAVyqSQ66YBqiNOZGYUSub9jpfgD6fD/RvNiT8AKgrJ7Ed9pJMUY59kYO3BgTuJ6kyHxXyKyZs3CDG/t6YihILaIw/MUyoIDg3uI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=BSK2NbeV; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="BSK2NbeV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 135031F00A3A; Thu, 28 May 2026 07:54:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779954853; bh=I2d5oVKWFapuiKgS4xshEtz8nHO/4J3uTHGwuhzdjnU=; h=Subject:To:Cc:From:Date; b=BSK2NbeV1rWuwIOg0MIdrvmcC17Es3QODrHBl1ZXUSwwNdZK8PLo7TOvL3ihdl7Vu sOLtK/uKgWqtdy9v/XkOl4qEhj2qiqC5EucoNi6Qq8vCkjVzDTOWvzKb7EA4yU/UOZ qeo2XtEE5/SbQfAup/FME8mRENK+1PDjIaaq971Y= Subject: FAILED: patch "[PATCH] net: devmem: reject dma-buf bind with non-page-aligned size" failed to apply to 6.18-stable tree To: devnexen@gmail.com,almasrymina@google.com,bobbyeshleman@meta.com,kuba@kernel.org,sdf@fomichev.me Cc: From: Date: Thu, 28 May 2026 09:53:20 +0200 Message-ID: <2026052820-passing-subject-c656@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y git checkout FETCH_HEAD git cherry-pick -x 4eb82ba543421e9e38cc14e4e82058b78850df50 # git commit -s git send-email --to '' --in-reply-to '2026052820-passing-subject-c656@gregkh' --subject-prefix 'PATCH 6.18.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 4eb82ba543421e9e38cc14e4e82058b78850df50 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Tue, 19 May 2026 21:35:30 +0100 Subject: [PATCH] net: devmem: reject dma-buf bind with non-page-aligned size or SG length net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without checking: - tx_vec is sized dmabuf->size / PAGE_SIZE, and net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size before indexing tx_vec[virt_addr / PAGE_SIZE]. With size = N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base = N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past. - owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner() covers the full byte len, so a non-page-multiple non-final sg desyncs num_niovs from the gen_pool region for every later sg, on both RX and TX. dma-buf does not require page-aligned sizes, so the bind path has to enforce what its own indexing assumes. Reject both with -EINVAL. The size check is TX-only (only tx_vec is sized off dmabuf->size); the SG-length check covers both directions. Fixes: bd61848900bf ("net: devmem: Implement TX path") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Reviewed-by: Bobby Eshleman Acked-by: Stanislav Fomichev Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20260519203530.66310-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski diff --git a/net/core/devmem.c b/net/core/devmem.c index 468344739db2..4f71de44c0fb 100644 --- a/net/core/devmem.c +++ b/net/core/devmem.c @@ -241,6 +241,11 @@ net_devmem_bind_dmabuf(struct net_device *dev, } if (direction == DMA_TO_DEVICE) { + if (!IS_ALIGNED(dmabuf->size, PAGE_SIZE)) { + err = -EINVAL; + NL_SET_ERR_MSG(extack, "TX dma-buf size must be a multiple of PAGE_SIZE"); + goto err_unmap; + } binding->tx_vec = kvmalloc_objs(struct net_iov *, dmabuf->size / PAGE_SIZE); if (!binding->tx_vec) { @@ -267,6 +272,12 @@ net_devmem_bind_dmabuf(struct net_device *dev, size_t len = sg_dma_len(sg); struct net_iov *niov; + if (!IS_ALIGNED(len, PAGE_SIZE)) { + err = -EINVAL; + NL_SET_ERR_MSG(extack, "dma-buf SG length must be PAGE_SIZE aligned"); + goto err_free_chunks; + } + owner = kzalloc_node(sizeof(*owner), GFP_KERNEL, dev_to_node(&dev->dev)); if (!owner) {