CVE-2023-53026

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/core: Fix ib block iterator counter overflow<br /> <br /> When registering a new DMA MR after selecting the best aligned page size<br /> for it, we iterate over the given sglist to split each entry to smaller,<br /> aligned to the selected page size, DMA blocks.<br /> <br /> In given circumstances where the sg entry and page size fit certain<br /> sizes and the sg entry is not aligned to the selected page size, the<br /> total size of the aligned pages we need to cover the sg entry is &gt;= 4GB.<br /> Under this circumstances, while iterating page aligned blocks, the<br /> counter responsible for counting how much we advanced from the start of<br /> the sg entry is overflowed because its type is u32 and we pass 4GB in<br /> size. This can lead to an infinite loop inside the iterator function<br /> because the overflow prevents the counter to be larger<br /> than the size of the sg entry.<br /> <br /> Fix the presented problem by changing the advancement condition to<br /> eliminate overflow.<br /> <br /> Backtrace:<br /> [ 192.374329] efa_reg_user_mr_dmabuf<br /> [ 192.376783] efa_register_mr<br /> [ 192.382579] pgsz_bitmap 0xfffff000 rounddown 0x80000000<br /> [ 192.386423] pg_sz [0x80000000] umem_length[0xc0000000]<br /> [ 192.392657] start 0x0 length 0xc0000000 params.page_shift 31 params.page_num 3<br /> [ 192.399559] hp_cnt[3], pages_in_hp[524288]<br /> [ 192.403690] umem-&gt;sgt_append.sgt.nents[1]<br /> [ 192.407905] number entries: [1], pg_bit: [31]<br /> [ 192.411397] biter-&gt;__sg_nents [1] biter-&gt;__sg [0000000008b0c5d8]<br /> [ 192.415601] biter-&gt;__sg_advance [665837568] sg_dma_len[3221225472]<br /> [ 192.419823] biter-&gt;__sg_nents [1] biter-&gt;__sg [0000000008b0c5d8]<br /> [ 192.423976] biter-&gt;__sg_advance [2813321216] sg_dma_len[3221225472]<br /> [ 192.428243] biter-&gt;__sg_nents [1] biter-&gt;__sg [0000000008b0c5d8]<br /> [ 192.432397] biter-&gt;__sg_advance [665837568] sg_dma_len[3221225472]