[bug report] iommu/io-pgtable-dart: Add 4-level page table support

[bug report] iommu/io-pgtable-dart: Add 4-level page table support

[Dan Carpenter]

Hello Hector Martin,

Commit 74a0e72f03ff ("iommu/io-pgtable-dart: Add 4-level page table
support") from Aug 21, 2025 (linux-next), leads to the following
(UNPUBLISHED) Smatch static checker warning:

drivers/iommu/io-pgtable-dart.c:183 dart_get_last() warn: array off by one? 'data->pgd[tbl]'
drivers/iommu/io-pgtable-dart.c:252 dart_map_pages() warn: array off by one? 'data->pgd[tbl]'

drivers/iommu/io-pgtable-dart.c
    174 static dart_iopte *dart_get_last(struct dart_io_pgtable *data, unsigned long iova)
    175 {
    176         dart_iopte pte, *ptep;
    177         int level = data->levels;
    178         int tbl = dart_get_index(data, iova, level);
    179 
    180         if (tbl > (1 << data->tbl_bits))
                        ^
It does look like this should be >=.

    181                 return NULL;
    182 
--> 183         ptep = data->pgd[tbl];

data->pgd[] has BIT(2) elements.  The data->tbl_bits value is set
in dart_alloc_pgtable() and it has a check if (tbl_bits > max_tbl_bits)
which ensures that it is not more than 2.

I don't think dart_get_index() can actually return more than 3 so
maybe the check can just be removed?

    184         if (!ptep)
    185                 return NULL;
    186 
    187         while (--level > 1) {
    188                 ptep += dart_get_index(data, iova, level);
    189                 pte = READ_ONCE(*ptep);
    190 
    191                 /* Valid entry? */
    192                 if (!pte)
    193                         return NULL;
    194 
    195                 /* Deref to get next level table */
    196                 ptep = iopte_deref(pte, data);
    197         }
    198 
    199         return ptep;
    200 }

regards,
dan carpenter

Re: [bug report] iommu/io-pgtable-dart: Add 4-level page table support

[Janne Grunau]

On Tue, Sep 09, 2025 at 01:31:50PM +0300, Dan Carpenter wrote:
> Hello Hector Martin,
> 
> Commit 74a0e72f03ff ("iommu/io-pgtable-dart: Add 4-level page table
> support") from Aug 21, 2025 (linux-next), leads to the following
> (UNPUBLISHED) Smatch static checker warning:
> 
> drivers/iommu/io-pgtable-dart.c:183 dart_get_last() warn: array off by one? 'data->pgd[tbl]'
> drivers/iommu/io-pgtable-dart.c:252 dart_map_pages() warn: array off by one? 'data->pgd[tbl]'
> 
> drivers/iommu/io-pgtable-dart.c
>     174 static dart_iopte *dart_get_last(struct dart_io_pgtable *data, unsigned long iova)
>     175 {
>     176         dart_iopte pte, *ptep;
>     177         int level = data->levels;
>     178         int tbl = dart_get_index(data, iova, level);
>     179 
>     180         if (tbl > (1 << data->tbl_bits))
>                         ^
> It does look like this should be >=.

yes. There is a second occurance of this buggy check in
dart_map_pages().

>     181                 return NULL;
>     182 
> --> 183         ptep = data->pgd[tbl];
> 
> data->pgd[] has BIT(2) elements.  The data->tbl_bits value is set
> in dart_alloc_pgtable() and it has a check if (tbl_bits > max_tbl_bits)
> which ensures that it is not more than 2.
> 
> I don't think dart_get_index() can actually return more than 3 so
> maybe the check can just be removed?

It can't as long as iova is within the iommu's ias. After brief check I
haven't seen anything in iommu/iommu.c or iommu/apple-dart.c which
prevents drivers to call iommu_map() with a random iova resulting in
tbl == 4. So the checks needs to be fixed.

I'll send a patch fixing both occurances.

Thanks for the report

Janne