From: Nicolin Chen <nicolinc@nvidia.com>
To: Jason Gunthorpe <jgg@nvidia.com>
Cc: <iommu@lists.linux.dev>, Joerg Roedel <joro@8bytes.org>,
Kevin Tian <kevin.tian@intel.com>,
<linux-kselftest@vger.kernel.org>,
Robin Murphy <robin.murphy@arm.com>,
Shuah Khan <shuah@kernel.org>, Will Deacon <will@kernel.org>,
Lixiao Yang <lixiao.yang@intel.com>,
Matthew Rosato <mjrosato@linux.ibm.com>,
<patches@lists.linux.dev>, <stable@vger.kernel.org>,
<syzbot+c2f65e2801743ca64e08@syzkaller.appspotmail.com>,
Yi Liu <yi.l.liu@intel.com>
Subject: Re: [PATCH 1/2] iommufd: Prevent ALIGN() overflow
Date: Fri, 18 Jul 2025 01:16:37 -0700 [thread overview]
Message-ID: <aHoC5c/PSLSZfVXG@Asurada-Nvidia> (raw)
In-Reply-To: <1-v1-7b4a16fc390b+10f4-iommufd_alloc_overflow_jgg@nvidia.com>
On Thu, Jul 17, 2025 at 04:15:08PM -0300, Jason Gunthorpe wrote:
> When allocating IOVA the candidate range gets aligned to the target
> alignment. If the range is close to ULONG_MAX then the ALIGN() can
> wrap resulting in a corrupted iova.
>
> Open code the ALIGN() using get_add_overflow() to prevent this.
> This simplifies the checks as we don't need to check for length earlier
> either.
>
> Consolidate the two copies of this code under a single helper.
>
> This bug would allow userspace to create a mapping that overlaps with some
> other mapping or a reserved range.
>
> Cc: stable@vger.kernel.org
> Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping")
> Reported-by: syzbot+c2f65e2801743ca64e08@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/r/685af644.a00a0220.2e5631.0094.GAE@google.com
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
next prev parent reply other threads:[~2025-07-18 8:17 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-17 19:15 [PATCH 0/2] Fix undetected overflow when allocating IOVA Jason Gunthorpe
2025-07-17 19:15 ` [PATCH 1/2] iommufd: Prevent ALIGN() overflow Jason Gunthorpe
2025-07-18 8:16 ` Nicolin Chen [this message]
2025-07-18 13:03 ` Yi Liu
2025-07-17 19:15 ` [PATCH 2/2] iommufd/selftest: Test reserved regions near ULONG_MAX Jason Gunthorpe
2025-07-17 19:15 ` kernel test robot
2025-07-18 2:45 ` Nicolin Chen
2025-07-18 8:13 ` Nicolin Chen
2025-07-18 16:21 ` Jason Gunthorpe
2025-07-18 18:23 ` Robin Murphy
2025-07-18 18:50 ` Nicolin Chen
2025-07-18 20:16 ` Jason Gunthorpe
2025-07-18 19:56 ` Jason Gunthorpe
2025-07-18 13:03 ` Yi Liu
2025-07-18 18:10 ` [PATCH 0/2] Fix undetected overflow when allocating IOVA Nicolin Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aHoC5c/PSLSZfVXG@Asurada-Nvidia \
--to=nicolinc@nvidia.com \
--cc=iommu@lists.linux.dev \
--cc=jgg@nvidia.com \
--cc=joro@8bytes.org \
--cc=kevin.tian@intel.com \
--cc=linux-kselftest@vger.kernel.org \
--cc=lixiao.yang@intel.com \
--cc=mjrosato@linux.ibm.com \
--cc=patches@lists.linux.dev \
--cc=robin.murphy@arm.com \
--cc=shuah@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+c2f65e2801743ca64e08@syzkaller.appspotmail.com \
--cc=will@kernel.org \
--cc=yi.l.liu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.