From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vk1-f170.google.com (mail-vk1-f170.google.com [209.85.221.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AE6673B7B96 for ; Tue, 7 Apr 2026 14:18:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775571484; cv=none; b=t0TsPbzn5U/ZNR1nbv6dvqb3bK9RuPraDNGzQU52NGkhfWL3LvsiyjYsKtHrquuH/q8xxfz4+4St5CxcLsi5g4OXi9fvDrnYNmppforMLYtBG+S2e+lYR9ESW4NUba10eUNdUrTBa/1QkvTfhliAAUApXfpoZtnCSMfynWpolnQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775571484; c=relaxed/simple; bh=W/Y2moVCx0pFV/yNmF0z4KZzsa7aIha3IhcxjDNS368=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=emF0KCoZZFbjmuBJLpg8VgcrgSMkl6Ta3ABCBTVC4YgP19HGLR+BoCbe2J65FKYuRgOUim//7x8zTV7GIZOek6MX1eZZ/uso4zrO8rsl8MliZsxEJR66C75O+FaYbqCBNbGc+0+iUfzOMLGhNAuiz44FnZI2NXwbd006mN1xMFg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RHeivRhH; arc=none smtp.client-ip=209.85.221.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RHeivRhH" Received: by mail-vk1-f170.google.com with SMTP id 71dfb90a1353d-56daad0fdbaso1290147e0c.3 for ; Tue, 07 Apr 2026 07:18:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775571482; x=1776176282; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=W0LRSDzC6gu/OoHknNvEWw02qs0lg4F1CkzYCQMjH1Q=; b=RHeivRhH45Nl1xLuTMBJ/UeyXZrz+y/PvHjO4U00dQhNswmSdS7crnas1B/TWa7zng a96uCJhPCO87SfCiD0MhPnv1haGVXeSMOtjBtFqYbg7EEiDB4P2wdfYdINuT2DVn4h7k KNWcC1fUX7M4CIed3vbZuZIYZ+LnIEV4V6DfAA86L++lwTtWb/uSVgHR8ukMXENf0q5e XWw44ZW5A7iJOrg7geECVnSznB82lt/7MMpfXoQZw0IYHfRRLMHSTh6/ohdIA2v073nY qDaUn6OFeaibx8VUOmWewtdQKbhRq5+z5HtxWr+HiFoSa49oiuuxO/V4y0JOAyoVDez0 gFjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775571482; x=1776176282; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=W0LRSDzC6gu/OoHknNvEWw02qs0lg4F1CkzYCQMjH1Q=; b=XATpabm/0kbrllRK7VaGhPrJYYVK1QnqX5AaqDpgMcefdvw9xuCpPK+fO2hin6LE4B pv2PvpDNT1veVINh/jm2ve1H4fvLeLy6hRDIbgGy0T+Wu5HJt4iF1Mq5eH48JgDOEvgk OfoZGWLqVWlGgiOhJ4oD6SAmegtXcyImtSbk38nHV/cGerWYgKYE1fl20f+X9kkqGEAh S9wibsH8BxWKd5aBUMMB5TVm8YwYyURs+tEZaPgGEVy6U8HWWAPDSZybW3hz9QmiM9cS CGg3rqPsXDZFHf6VSexGSiPP+5EymD60Y3Cnz2sAMe1ryJS1As3e+TdqhiyYUuLY2Dt5 6IOQ== X-Forwarded-Encrypted: i=1; AJvYcCUXScnbjG32ueE5x3G1CtYmJqYaTr87Draxz27yL6hnxsdIvjhAH3H3FPAvGbF6HXC7XlpAGLCKOjdSAGw=@vger.kernel.org X-Gm-Message-State: AOJu0YwksIGFFGk3pT6mH7iXpgH493gAtiZjqmS8Rd0iZTisChfIy5eO fChhA4MPlgf/f34Xv1lqAHKOechgDXKe9hNPyM4+IiA05+Zg9YI+znXa X-Gm-Gg: AeBDieshxtMsZBwFpMV+ZjYFaw32EqEMbmnBGq1M87SqJXohGH5iLGvFDpf0FGk4Tb/ bdpwOBOTdLrnAtQya+2+PYfHFxGweT4sueB9rlzKiyvEjwVeomGCzk2li96sU49ulDiq/J5rXw+ MK4YWW3POZ5oqcM9kHIZZOAcE66BoMJmkCwdMgMv91UUTP+p62GLg5J2i00V4PnVZlUhQMvn4W7 uyaGPHSJllIbZPCqEXZNVCTyXR8/f5rNRAJfGjZiT6+EBTrHSf/HzUdc4Oel33omQ9ScfqimGHR TULIkA/pyXM6exBU6C5B5R93YsS/ggG3VpVL9HvFgrLLu0ibYR5f0+fyXydv/RpmV1P5y15BsE5 mOWlXCGkLnSm325T07JFNkrtjKTCJ1wIV6nvk8uKNodeBd28lfY0aNtvysaXheYwxIGR33Od0D2 0JZLsQZz3zH2UjDpXeWhJt8qIM X-Received: by 2002:a05:6122:4893:b0:56d:7b2e:89a1 with SMTP id 71dfb90a1353d-56dab86455amr5676845e0c.4.1775571478262; Tue, 07 Apr 2026 07:17:58 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac6:d6d8:aa::11:1b5]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-56d9bd0a8a3sm19673793e0c.17.2026.04.07.07.17.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Apr 2026 07:17:57 -0700 (PDT) From: Sebastian Alba Vives To: gregkh@linuxfoundation.org, yilun.xu@linux.intel.com Cc: linux-fpga@vger.kernel.org, conor.dooley@microchip.com, mdf@kernel.org, linux-kernel@vger.kernel.org, Sebastian Alba Vives Subject: [PATCH v3 2/3] fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Date: Tue, 7 Apr 2026 08:17:35 -0600 Message-ID: <20260407141735.17394-1-sebasjosue84@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260402125446.3776153-2-sebasjosue84@gmail.com> References: <20260402125446.3776153-2-sebasjosue84@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large. Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX. Signed-off-by: Sebastian Alba Vives --- Changes in v3: - Move the upper-bound check on map.length to afu_ioctl_dma_map() at the ioctl entry point, before crossing the userspace/kernel boundary, instead of deep in afu_dma_pin_pages(). Revert changes to dfl-afu-dma-region.c from v1/v2. Suggested by Greg Kroah-Hartman. Changes in v2: - Added cap at INT_MAX in afu_dma_pin_pages() (superseded by v3). --- drivers/fpga/dfl-afu-main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/fpga/dfl-afu-main.c b/drivers/fpga/dfl-afu-main.c index 3bf8e73..097a97e 100644 --- a/drivers/fpga/dfl-afu-main.c +++ b/drivers/fpga/dfl-afu-main.c @@ -723,6 +723,9 @@ afu_ioctl_dma_map(struct dfl_feature_dev_data *fdata, void __user *arg) if (map.argsz < minsz || map.flags) return -EINVAL; + if (map.length >> PAGE_SHIFT > (u64)INT_MAX) + return -EINVAL; + ret = afu_dma_map_region(fdata, map.user_addr, map.length, &map.iova); if (ret) return ret; -- 2.43.0