Re: [PATCH] iommu/dma: Catch scatterlist length overflows

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] iommu/dma: missed scatterlist length overflow on 32-bit architectures
--

commit c8808dcafa857db06b75cf791820b2414095b3cc
Author: Krzysztof Karas <krzysztof.karas@intel.com>

iommu/dma: Catch scatterlist length overflows

It is possible, when a very large mapping uses only one scatterlist, that
padding overflows scatterlist's length field. Address this issue by adding
overflow detection for scatterlist length field.

> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
> index 58c624513cd43..06edb4056dc1b 100644
> --- a/drivers/iommu/dma-iommu.c
> +++ b/drivers/iommu/dma-iommu.c
> @@ -1477,6 +1477,11 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
>  		sg_dma_len(s) = s_length;
>  		s->offset -= s_iova_off;
>  		s_length = iova_align(iovad, s_length + s_iova_off);
> +		if (overflows_type(s_length, s->length)) {
> +			ret = -EOVERFLOW;
> +
> +			goto out_restore_sg;
> +		}

[Severity: Medium]
Does this catch scatterlist length wrapping on 32-bit architectures?

If a caller provides a scatterlist segment with a length close to 4GB
on a 32-bit system, s_length and s_iova_off are both size_t. Their addition
and the subsequent iova_align() will silently wrap around in 32-bit
arithmetic before the overflows_type() check is reached.

Because s_length has already wrapped, overflows_type() will evaluate if the
wrapped 32-bit value fits inside a 32-bit unsigned int (s->length), which
always returns false.

In contrast, the subsequent pad_len check correctly uses
check_add_overflow(), avoiding this pitfall. Could a similar approach be
used here?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261002053320.3145901-1-krzysztof.karas@intel.com?part=1