From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5184D43636A; Mon, 17 Aug 2026 14:53:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786978414; cv=none; b=HmHOZuNbopLi5kmLA7p4+K9lnMcqQsRtNbRkEKtZOnx/4ygBykLDSo6yaVm9ci5OgA+ID1enATpAmYB8L59DNlkS9sKsUeZn0Eypnqu0GBNGhkXhZ1Ph0fP7GmDROnlCCUR9DvB0n7/xHDo+T7XZTE/NQIxpkW3GW798u11hIqo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786978414; c=relaxed/simple; bh=Oqld6HJdJ1sKqhZ5vnaDMiZIjqT+ZYT1grtSL7/4N5g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YoYcTwbI1P6nNiVjyh7dN8ZY9SQ8cDcYDtN9TSo2WY05Iw2+Eet+ZESPzrFrf6GKsp25FCQVPZAGXjWCWDd1c6SxyxsQYDOdNVqjsRr4Cdowa2OuklQ/gp6hXDDO1XwJBl1F1C327WZ0soA4EWj2ol/VWiQQ23TxDuoZg2GWz1o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iOyWIcTq; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="iOyWIcTq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AB14C1F000E9; Mon, 17 Aug 2026 14:53:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786978413; bh=aNgRlOcNrPm7EIht9elrs1eVEt/Pt2U72PwlG/+R9Nw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=iOyWIcTqZmQpvr76Ee0uAuFP94btDvY5LvAhGiIB3AWLkZm2G8a9HM09KS213fn8h PED9YdnIVV6AEne+dN0Abr5lKMgnRQTw2cMq7KmFaVZ/fE58V5egttw/bI36YoG8nh +dNmt4sb6lJwcnlzrAYapSh3To+XGNeTxzdlrrUE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, "Michael S. Tsirkin" , Yousef Alhouseen , Sasha Levin Subject: [PATCH 6.6 028/156] vhost/vdpa: reject overflowing PA map page counts on 32-bit Date: Mon, 17 Aug 2026 15:32:42 +0200 Message-ID: <20260817132535.727970645@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132534.666299318@linuxfoundation.org> References: <20260817132534.666299318@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yousef Alhouseen [ Upstream commit 0619aaa34c0c2a2dcb07f0e9c8a34e7efb8c4cdf ] vhost_vdpa_pa_map() adds the IOVA page offset to the user-controlled map size before computing the number of pages to pin. On 32-bit systems, where unsigned long is narrower than u64, that addition can overflow and the code can pin and map fewer pages than the requested IOTLB range. Reject sizes that overflow the unsigned long page-count calculation. Fixes: 22af48cf91aa ("vdpa: factor out vhost_vdpa_pa_map() and vhost_vdpa_pa_unmap()") Acked-by: Michael S. Tsirkin Signed-off-by: Yousef Alhouseen Signed-off-by: Michael S. Tsirkin Message-ID: Signed-off-by: Sasha Levin --- drivers/vhost/vdpa.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index 3645d83f240d9..5e2f7f4477679 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -998,6 +998,7 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, unsigned int gup_flags = FOLL_LONGTERM; unsigned long npages, cur_base, map_pfn, last_pfn = 0; unsigned long lock_limit, sz2pin, nchunks, i; + unsigned long page_offset; u64 start = iova; long pinned; int ret = 0; @@ -1010,7 +1011,13 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, if (perm & VHOST_ACCESS_WO) gup_flags |= FOLL_WRITE; - npages = PFN_UP(size + (iova & ~PAGE_MASK)); + page_offset = iova & ~PAGE_MASK; + if (size > ULONG_MAX - page_offset) { + ret = -EINVAL; + goto free; + } + + npages = PFN_UP(size + page_offset); if (!npages) { ret = -EINVAL; goto free; -- 2.53.0