Linux kernel (drivers/iommu): Every peer-to-peer segment in a scatter-gather list inherits the length of the first

Impact

Every peer-to-peer segment in a scatter-gather list inherits the length of the first segment, so the IOMMU is programmed with DMA lengths that do not match the actual buffers. Devices read and write past the end of short segments and silently truncate long ones - cross-buffer memory corruption on exactly the peer-to-peer path that GPUDirect and GPU-to-NIC traffic runs over.

Who can reach it

Any workload that drives PCI peer-to-peer DMA through dma_map_sg reaches this: GPUDirect RDMA from a tenant holding /dev/infiniband/uverbs* plus /dev/dri/renderD*, NVMe peer-to-peer, or GPU-to-NIC staging. No elevated privilege is required and no unusual configuration beyond PCI P2PDMA being in use with multi-segment scatterlists, which is the normal case for large transfers.

What to do

Update to a stable kernel carrying commits 8646f00c / db50fb87 (no fixed-version list was published by the kernel CNA - confirm the backport with your distro). Interim: disable PCI P2PDMA / GPUDirect peer-to-peer for tenant workloads if your stack allows it, since the corruption only occurs on the P2PDMA branch of iommu_dma_map_sg().

References