Re: [PATCH v4 2/5] iommu/dma: Catch scatterlist length overflows

[Sebastian Brzezinka <sebastian.brzezinka@intel.com>]

Hi,
On Thu Jul 23, 2026 at 12:25 PM CEST, Krzysztof Karas wrote:
> It is possible, when a very large mapping uses only one
> scatterlist, that padding overflows scatterlist's length field.
> This results in:
>  1) silently wrapping the value
>  2) smaller than desired mappings produced by iommu_map_sg
>  3) leaving mapped bytes in memory (no iommu_unmap)
>
> Address this issue by adding overflow detection for scatterlist
> length field.
>
> Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
> Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
> Reviewed-by: Robin Murphy <robin.murphy@arm.com>
> ---
> v4:
>  * Added value wrap check before s->length assignment (Robin);
>
>  drivers/iommu/dma-iommu.c | 20 +++++++++++++++++++-
>  1 file changed, 19 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
> index 381b60d9e7ce..3ca3196a41b0 100644
> --- a/drivers/iommu/dma-iommu.c
> +++ b/drivers/iommu/dma-iommu.c
> @@ -21,6 +21,7 @@
>  #include <linux/iommu-dma.h>
>  #include <linux/iova.h>
>  #include <linux/irq.h>
> +#include <linux/limits.h>
>  #include <linux/list_sort.h>
>  #include <linux/memremap.h>
>  #include <linux/mm.h>
> @@ -1477,6 +1478,12 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
>  		sg_dma_len(s) = s_length;
>  		s->offset -= s_iova_off;
>  		s_length = iova_align(iovad, s_length + s_iova_off);
> +		if ((s_length & UINT_MAX) == 0) {
Might be better to go with  s_length > UINT_MAX . Right now it's 64 &
32, so only the lower bits count. Or just ignore this comment  it if
it's intended.

-- 
Best regards,
Sebastian