Commit e586e229 authored by Jason Gunthorpe's avatar Jason Gunthorpe Committed by Joerg Roedel
Browse files

iommu: Protect against overflow in iommu_pgsize() 



On a 32 bit system calling:
 iommu_map(0, 0x40000000)

When using the AMD V1 page table type with a domain->pgsize of 0xfffff000
causes iommu_pgsize() to miscalculate a result of:
  size=0x40000000 count=2

count should be 1. This completely corrupts the mapping process.

This is because the final test to adjust the pagesize malfunctions when
the addition overflows. Use check_add_overflow() to prevent this.

Fixes: b1d99dc5 ("iommu: Hook up '->unmap_pages' driver callback")
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Reviewed-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/0-v1-3ad28fc2e3a3+163327-iommu_overflow_pgsize_jgg@nvidia.com


Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
parent da33e87b

drivers/iommu/iommu.c

+3 −1
Original line number Diff line number Diff line
@@ -2413,6 +2413,7 @@ static size_t iommu_pgsize(struct iommu_domain *domain, unsigned long iova, 
	unsigned int pgsize_idx, pgsize_idx_next;

	unsigned long pgsizes;

	size_t offset, pgsize, pgsize_next;

	size_t offset_end;

	unsigned long addr_merge = paddr | iova;



	/* Page sizes supported by the hardware and small enough for @size */
@@ -2453,7 +2454,8 @@ static size_t iommu_pgsize(struct iommu_domain *domain, unsigned long iova, 
	 * If size is big enough to accommodate the larger page, reduce

	 * the number of smaller pages.

	 */

	if (offset + pgsize_next <= size)

	if (!check_add_overflow(offset, pgsize_next, &offset_end) &&

	    offset_end <= size)

		size = offset;



out_set_count: