Re: [PATCH v3 02/32] iommu/io-pgtable-arm: introduce iova_to_phys_length in io_pgtable_ops

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] arm_lpae_iova_to_phys_length unconditionally returns the full block size instead of the remaining mapped length from the given IOVA.
--

commit c1536d0ff7a2be05195b8dfb8b49fd2e59d5c8f3
Author: Guanghui Feng <guanghuifeng@linux.alibaba.com>

iommu/io-pgtable-arm: introduce iova_to_phys_length in io_pgtable_ops

This commit adds a new iova_to_phys_length callback to struct io_pgtable_ops
and implements it for the ARM LPAE backend to return both the physical address
and the length of the mapping. The existing iova_to_phys is updated to wrap
the new callback.

> diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
> --- a/drivers/iommu/io-pgtable-arm.c
> +++ b/drivers/iommu/io-pgtable-arm.c
[ ... ]
> @@ -776,13 +789,18 @@ static phys_addr_t arm_lpae_iova_to_phys(struct io_pgtable_ops *ops,
[ ... ]
>  	ret = __arm_lpae_iopte_walk(data, &walk_data, data->pgd, data->start_level);
>  	if (ret)
> -		return 0;
> +		return PHYS_ADDR_MAX;
> +
> +	block_size = ARM_LPAE_BLOCK_SIZE(d.lvl, data);
> +	if (mapped_length)
> +		*mapped_length = block_size;

[Severity: Critical]
Does this code return the correct length if the iova is not perfectly aligned
to the block boundary?

If the provided iova has an offset within the block, unconditionally assigning
the full block_size to *mapped_length might cause callers to overestimate the
contiguous physical memory mapped starting from that specific iova.

The actual remaining contiguous memory in the block from the iova would be
block_size - (iova & (block_size - 1)). Could returning the full block size
cause callers to overrun into unmapped physical memory or memory belonging to
other processes?

>  
> -	iova &= (ARM_LPAE_BLOCK_SIZE(d.lvl, data) - 1);
> +	iova &= (block_size - 1);
>  	return iopte_to_paddr(d.pte, data) | iova;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260603151804.1963871-1-guanghuifeng@linux.alibaba.com?part=2