[PATCH v2] iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()

Qasim Ijaz
2025-01-13T22:39:42Z

Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where
shifting the constant "1" (of type int) by bitmap->mapped.pgshift
(an unsigned long value) could result in undefined behavior.

The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63)
the shift operation overflows, as the result cannot be represented in a 32-bit type.

To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type
to match the operand's type.

Reported-by: syzbot <syzbot+85992ace37d5b7b51635@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support")
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
---
drivers/iommu/iommufd/iova_bitmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c
index ab665cf38ef4..39a86a4a1d3a 100644
--- a/drivers/iommu/iommufd/iova_bitmap.c
+++ b/drivers/iommu/iommufd/iova_bitmap.c
@@ -130,7 +130,7 @@ struct iova_bitmap {
static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap,
unsigned long iova)
{
- unsigned long pgsize = 1 << bitmap->mapped.pgshift;
+ unsigned long pgsize = 1UL << bitmap->mapped.pgshift;

return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize);
}
--
2.39.5