[PATCH] iommu: Protect against overflow in iommu_pgsize()

[PATCH] iommu: Protect against overflow in iommu_pgsize()

[Jason Gunthorpe]

On a 32 bit system calling:
 iommu_map(0, 0x40000000)

When using the AMD V1 page table type with a domain->pgsize of 0xfffff000
causes iommu_pgsize() to miscalculate a result of:
  size=0x40000000 count=2

count should be 1. This completely corrupts the mapping process.

This is because the final test to adjust the pagesize malfunctions when
the addition overflows. Use check_add_overflow() to prevent this.

Fixes: b1d99dc5f983 ("iommu: Hook up '->unmap_pages' driver callback")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/iommu/iommu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

The iommupt test suite trips on up this, I don't think anything real would be
able to trigger this. Sorry for the second email, I typod and the mail lists
did not get included.

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index c8033ca6637771..642d0a03172b0b 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -2392,6 +2392,7 @@ static size_t iommu_pgsize(struct iommu_domain *domain, unsigned long iova,
 	unsigned int pgsize_idx, pgsize_idx_next;
 	unsigned long pgsizes;
 	size_t offset, pgsize, pgsize_next;
+	size_t offset_end;
 	unsigned long addr_merge = paddr | iova;
 
 	/* Page sizes supported by the hardware and small enough for @size */
@@ -2432,7 +2433,8 @@ static size_t iommu_pgsize(struct iommu_domain *domain, unsigned long iova,
 	 * If size is big enough to accommodate the larger page, reduce
 	 * the number of smaller pages.
 	 */
-	if (offset + pgsize_next <= size)
+	if (!check_add_overflow(offset, pgsize_next, &offset_end) &&
+	    offset_end <= size)
 		size = offset;
 
 out_set_count:

base-commit: 2a485c0aa33a8cbf224d92667d2b274e1fd3b300
-- 
2.43.0

Re: [PATCH] iommu: Protect against overflow in iommu_pgsize()

[Baolu Lu]

On 4/25/25 21:08, Jason Gunthorpe wrote:
> On a 32 bit system calling:
>   iommu_map(0, 0x40000000)
> 
> When using the AMD V1 page table type with a domain->pgsize of 0xfffff000
> causes iommu_pgsize() to miscalculate a result of:
>    size=0x40000000 count=2
> 
> count should be 1. This completely corrupts the mapping process.
> 
> This is because the final test to adjust the pagesize malfunctions when
> the addition overflows. Use check_add_overflow() to prevent this.
> 
> Fixes: b1d99dc5f983 ("iommu: Hook up '->unmap_pages' driver callback")
> Signed-off-by: Jason Gunthorpe<jgg@nvidia.com>

Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>

Re: [PATCH] iommu: Protect against overflow in iommu_pgsize()

[Joerg Roedel]

On Fri, Apr 25, 2025 at 10:08:37AM -0300, Jason Gunthorpe wrote:
>  drivers/iommu/iommu.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Applied, thanks.