Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately unpinned but the umem_dmabuf->pinned flag is still set. Then, when ib_umem_release() is called, it calls ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again. Fix this by removing the immediate unpin upon failure and just let the ib_umem_release/revoke path handle it. This also ensures the proper unmap-unpin unwind ordering if the dmabuf_map_pages call happened to fail due to dma_resv_wait_timeout (and therefore has a non-NULL umem_dmabuf->sgt).
Product status
1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before 70542b69abff34d24b11ae0bb200cc7a766d18df
1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before b324327ff6f48d8065dca67eb3b91357e72726bd
1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before ba3bf0f1bf1d5d0404678485e872980532fcc2c4
1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf
1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before 40126bcbefa79ea86672e05dae608596bab38319
1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before 104016eb671e19709721c1b0048dd912dc2e96be
5.16
Any version before 5.16
6.1.165 (semver)
6.6.128 (semver)
6.12.75 (semver)
6.18.16 (semver)
6.19.6 (semver)
7.0 (original_commit_for_fix)
References
git.kernel.org/...c/70542b69abff34d24b11ae0bb200cc7a766d18df
git.kernel.org/...c/b324327ff6f48d8065dca67eb3b91357e72726bd
git.kernel.org/...c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4
git.kernel.org/...c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf
git.kernel.org/...c/40126bcbefa79ea86672e05dae608596bab38319
git.kernel.org/...c/104016eb671e19709721c1b0048dd912dc2e96be