CVE-2026-68330: net: airoha: Fix DMA direction for NPU mailbox buffer

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Fix DMA direction for NPU mailbox buffer

airoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE,
but some callers expect the NPU to write response data back into the
same buffer:

- airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into
  the buffer, then the caller reads it via memcpy()
- airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back
  npu_stats_addr field in the response

On non-cache-coherent architectures like EN7581 (Cortex-A53 without
hardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op
— it does not invalidate the CPU cache. If the NPU-written cache line
is still present in the CPU cache when the caller reads the buffer,
the CPU observes stale data instead of the NPU response.

This is a timing-sensitive bug: small mailbox buffers (~24 bytes)
typically fit in a single cache line and may survive in the cache
until the caller reads them, producing silent data corruption rather
than a crash. The bug is more likely to trigger when the caller reads
the response immediately after dma_unmap_single() without intervening
cache-evicting operations.

Fix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures
dma_unmap_single() invalidates the CPU cache on non-coherent systems.
The mailbox buffers are small so there is no performance concern.

The Linux kernel CVE team has assigned CVE-2026-68330 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.16 with commit c52918744ee1e49cea86622a2633b9782446428f and fixed in 6.18.42 with commit 76fc5604308a109bf5838c2a0a0eb3ac6819f1ea
	Issue introduced in 6.16 with commit c52918744ee1e49cea86622a2633b9782446428f and fixed in 7.1.6 with commit 4c4d866a64f36718cbcdf20add372a599dd44311
	Issue introduced in 6.16 with commit c52918744ee1e49cea86622a2633b9782446428f and fixed in 7.2-rc5 with commit 6f884eb87a79e0c482baef2ad96c96b81d024235

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68330
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/airoha/airoha_npu.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/76fc5604308a109bf5838c2a0a0eb3ac6819f1ea
	https://git.kernel.org/stable/c/4c4d866a64f36718cbcdf20add372a599dd44311
	https://git.kernel.org/stable/c/6f884eb87a79e0c482baef2ad96c96b81d024235