Re: [PATCH rc] iommufd: Don't overflow during division for dirty tracking

[Joao Martins <joao.m.martins@oracle.com>]

On 08/10/2025 19:17, Jason Gunthorpe wrote:
> If pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow
> to 0 and this triggers divide by 0.
> 
> In this case the index should just be 0, so reorganize things to divide
> by shift and avoid hitting any overflows.
> 
> Cc: stable@vger.kernel.org
> Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support")
> Reported-by: syzbot+093a8a8b859472e6c257@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=093a8a8b859472e6c257
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

Reviewed-by: Joao Martins <joao.m.martins@oracle.com>

> ---
>  drivers/iommu/iommufd/iova_bitmap.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c
> index 4514575818fc07..b5b67a9d3fb35e 100644
> --- a/drivers/iommu/iommufd/iova_bitmap.c
> +++ b/drivers/iommu/iommufd/iova_bitmap.c
> @@ -130,9 +130,8 @@ struct iova_bitmap {
>  static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap,
>  						 unsigned long iova)
>  {
> -	unsigned long pgsize = 1UL << bitmap->mapped.pgshift;
> -
> -	return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize);
> +	return (iova >> bitmap->mapped.pgshift) /
> +	       BITS_PER_TYPE(*bitmap->bitmap);
>  }
>  
>  /*
> 
> base-commit: 2a918911ed3d0841923525ed0fe707762ee78844