Re: [PATCH v3 1/2] iommu: Add iommu_get_pci_resv_windows() helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] iommu: integer truncation of PCI MMIO window length on 32-bit systems
--

commit 913f9140edb50fcf9c22ac52938eee20ee68edc7
Author: Guanghui Feng <guanghuifeng@linux.alibaba.com>

iommu: Add iommu_get_pci_resv_windows() helper

This commit adds a common helper that walks a PCI device's host bridge MMIO
windows and returns them as IOMMU_RESV_RESERVED regions in a list. It
provides a reusable interface for subsystems that need visibility into PCI
host bridge MMIO address ranges, such as iommufd.

> diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
> index b486b8bbd1fcd..be774edef550f 100644
> --- a/drivers/iommu/iommu.c
> +++ b/drivers/iommu/iommu.c
[ ... ]
> @@ -945,6 +945,63 @@ iommu_insert_device_resv_regions(struct list_head *dev_resv_regions,
>  	return ret;
>  }
>  
> +#ifdef CONFIG_PCI
> +/**
> + * iommu_get_pci_resv_windows - collect PCI host bridge MMIO windows as
> + *                               reserved regions
[ ... ]
> +int iommu_get_pci_resv_windows(struct pci_dev *dev, struct list_head *head)
> +{
> +	struct pci_host_bridge *bridge = pci_find_host_bridge(dev->bus);
> +	struct iommu_resv_region *region, *next;
> +	struct resource_entry *window;
> +	LIST_HEAD(resv_windows);
> +	int ret;
> +
> +	if (!bridge)
> +		return -ENODEV;
> +
> +	resource_list_for_each_entry(window, &bridge->windows) {
> +		struct iommu_resv_region tmp = {
> +			.type = IOMMU_RESV_RESERVED,
> +		};
> +
> +		if (resource_type(window->res) != IORESOURCE_MEM)
> +			continue;
> +
> +		tmp.start = window->res->start - window->offset;
> +		tmp.length = window->res->end - window->res->start + 1;

[Severity: Medium]
On 32-bit systems with 64-bit physical addressing (e.g. ARM LPAE or x86 PAE),
if a PCI host bridge has an MMIO window larger than 4GB, does this implicitly
truncate the 64-bit resource_size_t value into the 32-bit size_t length field
of struct iommu_resv_region?

This truncation could allow IOVA allocations to overlap with PCI MMIO windows,
leading to IOMMU faults, unexpected peer-to-peer routing, and potential memory
corruption.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261004162213.3787623-2-guanghuifeng@linux.alibaba.com?part=1