Re: [PATCH v2 06/11] ARM: dma-mapping: Handle foreign buffers in arm_iommu_get_sgtable

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] arm/dma-mapping: invalid cast in __atomic_get_pages causes kernel panic on mmap/sgtable
--

commit 0f1d7f693768ddb66d127fa1093856300ee17984
Author: Mikko Perttunen <mperttunen@nvidia.com>

ARM: dma-mapping: Handle foreign buffers in arm_iommu_get_sgtable

This commit updates arm_iommu_get_sgtable() to handle foreign buffers
that were not allocated through arm_iommu_alloc_attrs(). Instead of
returning an error, it falls back to describing the buffer as a single
chunk, similar to how iommu_dma_get_sgtable() operates.

> diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
> index d6315baeddb9c..c2ec4f1078083 100644
> --- a/arch/arm/mm/dma-mapping.c
> +++ b/arch/arm/mm/dma-mapping.c
> @@ -1169,12 +1169,29 @@ static int arm_iommu_get_sgtable(struct device *dev, struct sg_table *sgt,
>  {
>  	unsigned int count = PAGE_ALIGN(size) >> PAGE_SHIFT;
>  	struct page **pages = __iommu_get_pages(cpu_addr, attrs);
> +	struct page *page;
> +	int ret;
>  
> -	if (!pages)
> -		return -ENXIO;
> +	if (pages)
> +		return sg_alloc_table_from_pages(sgt, pages, count, 0, size,
> +						 GFP_KERNEL);

[Severity: High]
Does this code still cause memory corruption when handling atomic pool
allocations?

The underlying __iommu_get_pages() function can return the result of
__atomic_get_pages(), which incorrectly casts a single struct page pointer to
an array of pointers:

arch/arm/mm/dma-mapping.c:__atomic_get_pages() {
    ...
    return (struct page **)page;
}

When arm_iommu_get_sgtable() receives this pointer, it passes it to
sg_alloc_table_from_pages(). That function iterates over the pointer as an
array, reading pages[i]. For pages[0], this reads the internal fields of the
page object (such as flags on 32-bit ARM) and interprets them as a page
pointer. Passing this uninitialized pointer to page_to_pfn() or get_page()
causes memory corruption and kernel panics.

Can this be triggered by userspace exporting a dma-buf or mmapping an
atomic-pool DMA buffer?

The same issue appears to be present in arm_iommu_mmap_attrs() which passes
the bogus array to vm_map_pages():

arch/arm/mm/dma-mapping.c:arm_iommu_mmap_attrs() {
    ...
    return vm_map_pages(vma, pages, nr_pages);
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016-b4-arm32-iommu-dma-cookie-v2-0-b06842a01938@nvidia.com?part=6