In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

The irdma_copy_user_pgaddrs function loops through all of the umem DMA
blocks to populate the PBLEs and will stop when either the last DMA
block is reached or palloc->total_cnt is reached. The issue is that
the logic for checking palloc->total_cnt would only work for non-zero
values.

When irdma_setup_pbles is called with lvl==0, it
calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means
the only way to break out of the loop is to reach the last umem DMA
block, which means it could end up going beyond the fixed size of 4
iwmr->pgaddrmem array that is used in the lvl==0 case.

In the case of QP/CQ/SRQ rings, the value of lvl is determined by a
separate input (for example, req.cq_pages in the case of a CQ). So,
we must perform explicit checking to ensure we don't overflow the
pgaddrmem array if the user provides a umem that consists of more
blocks than their provided req.cq_pages.

https://git.kernel.org/stable/c/192a3be0e3759daa24af2841208b074ca6dbaabc

https://git.kernel.org/stable/c/424d51d33c7541a86934067c2c0538124687fc90

https://git.kernel.org/stable/c/4780f58672ee6328accd54a95f9c00683477e499

https://git.kernel.org/stable/c/5ebb3ed757be3e04cf803026004aa0beaeb13e9b

https://git.kernel.org/stable/c/79a20a8e201a779224b4bf115250a7713bde72c0

https://git.kernel.org/stable/c/9f8f0d2099e3de1194e37dc933ae0c4206b09aaf

https://git.kernel.org/stable/c/abd27a977b419d584efa659488c22d2306987b29

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","lessThan":"4780f58672ee6328accd54a95f9c00683477e499","versionType":"git","status":"affected"},{"version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","lessThan":"79a20a8e201a779224b4bf115250a7713bde72c0","versionType":"git","status":"affected"},{"version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","lessThan":"9f8f0d2099e3de1194e37dc933ae0c4206b09aaf","versionType":"git","status":"affected"},{"version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","lessThan":"192a3be0e3759daa24af2841208b074ca6dbaabc","versionType":"git","status":"affected"},{"version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","lessThan":"424d51d33c7541a86934067c2c0538124687fc90","versionType":"git","status":"affected"},{"version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","lessThan":"abd27a977b419d584efa659488c22d2306987b29","versionType":"git","status":"affected"},{"version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","lessThan":"5ebb3ed757be3e04cf803026004aa0beaeb13e9b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]