Re: [bug report] iommu/io-pgtable-dart: Add 4-level page table support

[Janne Grunau <j@jannau.net>]

On Tue, Sep 09, 2025 at 01:31:50PM +0300, Dan Carpenter wrote:
> Hello Hector Martin,
> 
> Commit 74a0e72f03ff ("iommu/io-pgtable-dart: Add 4-level page table
> support") from Aug 21, 2025 (linux-next), leads to the following
> (UNPUBLISHED) Smatch static checker warning:
> 
> drivers/iommu/io-pgtable-dart.c:183 dart_get_last() warn: array off by one? 'data->pgd[tbl]'
> drivers/iommu/io-pgtable-dart.c:252 dart_map_pages() warn: array off by one? 'data->pgd[tbl]'
> 
> drivers/iommu/io-pgtable-dart.c
>     174 static dart_iopte *dart_get_last(struct dart_io_pgtable *data, unsigned long iova)
>     175 {
>     176         dart_iopte pte, *ptep;
>     177         int level = data->levels;
>     178         int tbl = dart_get_index(data, iova, level);
>     179 
>     180         if (tbl > (1 << data->tbl_bits))
>                         ^
> It does look like this should be >=.

yes. There is a second occurance of this buggy check in
dart_map_pages().

>     181                 return NULL;
>     182 
> --> 183         ptep = data->pgd[tbl];
> 
> data->pgd[] has BIT(2) elements.  The data->tbl_bits value is set
> in dart_alloc_pgtable() and it has a check if (tbl_bits > max_tbl_bits)
> which ensures that it is not more than 2.
> 
> I don't think dart_get_index() can actually return more than 3 so
> maybe the check can just be removed?

It can't as long as iova is within the iommu's ias. After brief check I
haven't seen anything in iommu/iommu.c or iommu/apple-dart.c which
prevents drivers to call iommu_map() with a random iova resulting in
tbl == 4. So the checks needs to be fixed.

I'll send a patch fixing both occurances.

Thanks for the report

Janne