Re: [PATCH v3 15/32] iommu/mtk_v1: implement iova_to_phys_length

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing IOVA bounds checking leads to out-of-bounds array read/write on the `pgt_va` array.
--

commit 3d307c9faf5208f019d6a8f030da9330ce0aa29b
Author: Guanghui Feng <guanghuifeng@linux.alibaba.com>

iommu/mtk_v1: implement iova_to_phys_length
    
Implement iova_to_phys_length for MediaTek v1 IOMMU driver,
returning the actual PTE mapping size.
Also fix pre-existing bug: add page offset to physical address.

> diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
> index ac97dd2868d4b..da41dda7620b8 100644
> --- a/drivers/iommu/mtk_iommu_v1.c
> +++ b/drivers/iommu/mtk_iommu_v1.c
[ ... ]
> -static phys_addr_t mtk_iommu_v1_iova_to_phys(struct iommu_domain *domain, dma_addr_t iova)
> +static phys_addr_t mtk_iommu_v1_iova_to_phys_length(struct iommu_domain *domain,
> +						    dma_addr_t iova,
> +						    size_t *mapped_length)
>  {
>  	struct mtk_iommu_v1_domain *dom = to_mtk_domain(domain);
>  	unsigned long flags;
> @@ -404,6 +406,13 @@ static phys_addr_t mtk_iommu_v1_iova_to_phys(struct iommu_domain *domain, dma_ad
>  	pa = pa & (~(MT2701_IOMMU_PAGE_SIZE - 1));

[Severity: High]
This is a pre-existing issue, but does this array access lack bounds
checking on the iova parameter?

Looking at the code just above this line in mtk_iommu_v1_iova_to_phys_length():
    pa = *(dom->pgt_va + (iova >> MT2701_IOMMU_PAGE_SHIFT));

Since the driver doesn't appear to initialize domain.geometry.aperture_end
or set force_aperture = true, the generic IOMMU layer won't enforce an
upper limit on the IOVA.

If a user-space program using VFIO or a device with a >32-bit DMA mask
requests an IOVA >= 4GB, the index calculated by
(iova >> MT2701_IOMMU_PAGE_SHIFT) could exceed the bounds of the 4MB
pgt_va array, leading to an out-of-bounds read here.

This same out-of-bounds access pattern also seems to occur in
mtk_iommu_v1_map() and mtk_iommu_v1_unmap() when calculating pgt_base_iova,
where it can lead to memory corruption during out-of-bounds writes.

>  	spin_unlock_irqrestore(&dom->pgtlock, flags);
>  
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260603151804.1963871-1-guanghuifeng@linux.alibaba.com?part=15