Commit 727e1f569855 for kernel

commit 727e1f569855df83579edbd73dcb4a0723543a12
Author: Christian Borntraeger <borntraeger@linux.ibm.com>
Date:   Mon Jul 6 16:15:37 2026 +0200

    vdpa/mlx5: Fix buffer length in create_direct_keys()

    We have seen in our CI the following KASAN message:
    BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core]
    Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764
    [...]
    [<000011388ab3a7a0>] cmd_exec+0x550/0xca0 [mlx5_core]
    [<000011388ab3b61c>] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core]
    [<000011388b21e82e>] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa]
    [<000011388b21fd44>] create_direct_keys+0x954/0xef0 [mlx5_vdpa]
    [...]
    The buggy address is located 4128 bytes inside of
    allocated 4384-byte region [0000000176794000, 0000000176795120)

    So in essence we read 16 bytes beyond 4384-byte allocation.
    create_direct_keys calculates the pointer and length for in and out
    buffers.
    The size calculation for in includes the entire structure
    size (out + in + mtt[]) but the pointer passed to cmd_exec points only
    to the 'in' field, skipping the 'out' field.

    This causes mlx5_copy_to_msg() to read beyond the allocated buffer
    by sizeof(out) bytes when copying command data.

    Properly calculate the input size to match the pointer and allocation size.

    Fixes: 0071b138d44a ("vdpa/mlx5: Create direct MKEYs in parallel")
    Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
    Tested-by: Dragos Tatulea <dtatulea@nvidia.com>
    Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Message-ID: <20260706141537.3510294-1-borntraeger@linux.ibm.com>

diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
index 7d681961a5cc..77a479aeaa85 100644
--- a/drivers/vdpa/mlx5/core/mr.c
+++ b/drivers/vdpa/mlx5/core/mr.c
@@ -233,7 +233,8 @@ static int create_direct_keys(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *
 		cmds[i].out = cmd_mem->out;
 		cmds[i].outlen = sizeof(cmd_mem->out);
 		cmds[i].in = cmd_mem->in;
-		cmds[i].inlen = struct_size(cmd_mem, mtt, mttcount);
+		cmds[i].inlen = struct_size(cmd_mem, mtt, mttcount) -
+				offsetof(struct mlx5_create_mkey_mem, in);

 		fill_create_direct_mr(mvdev, dmr, cmd_mem);