* Re: [PATCH] iommu: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
@ 2025-01-13 22:45 Qasim Ijaz
0 siblings, 0 replies; 5+ messages in thread
From: Qasim Ijaz @ 2025-01-13 22:45 UTC (permalink / raw)
To: Joao Martins, Jason Gunthorpe
Cc: Kevin Tian, Joerg Roedel, Will Deacon, Robin Murphy, iommu,
linux-kernel
On Mon, Jan 13, 2025 at 04:25:29PM +0000, Joao Martins wrote:
> On 13/01/2025 16:22, Jason Gunthorpe wrote:
> > On Mon, Jan 13, 2025 at 12:00:29PM +0000, Joao Martins wrote:
> >> On 12/01/2025 12:39, Qasim Ijaz wrote:
> >>> This patch resolves a UBSAN shift-out-of-bounds issue in
> >>
> >> Avoid the 'this patch' e.g. Resolve a UBSAN shift-out-of-bonds (...)
> >>
> >> The Subject component part could also be a bit more specific e.g.
> >>
> >> iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
> >>
> >>> iova_bitmap_offset_to_index() where shifting the constant "1" (of type int)
> >>> by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior.
> >>>
> >>> The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63)
> >>> the shift operation overflows, as the result cannot be represented in a 32-bit type.
> >>>
> >>> To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type
> >>> to match the operand's type.
> >>>
> >>> Reported-by: syzbot <syzbot+85992ace37d5b7b51635@syzkaller.appspotmail.com>
> >>> Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
> >>> Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
> >>
> >> With those two nits:
> >>
> >> Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
> >
> > It needs a fixes line too
>
> It should be
>
> Fixes: 495c06d82ba ("vfio: Add an IOVA bitmap support")
>
> Joao
Thank you for your feedback on the initial patch Jason and Joao. I’ve incorporated your suggestions and submitted a v2 patch for review.
Please let me know if further adjustments are needed.
Best regards,
Qasim
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH] iommu: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
@ 2025-01-12 12:39 Qasim Ijaz
2025-01-13 12:00 ` Joao Martins
0 siblings, 1 reply; 5+ messages in thread
From: Qasim Ijaz @ 2025-01-12 12:39 UTC (permalink / raw)
To: Jason Gunthorpe, Kevin Tian, Joerg Roedel, Will Deacon,
Robin Murphy
Cc: iommu, linux-kernel
This patch resolves a UBSAN shift-out-of-bounds issue in
iova_bitmap_offset_to_index() where shifting the constant "1" (of type int)
by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior.
The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63)
the shift operation overflows, as the result cannot be represented in a 32-bit type.
To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type
to match the operand's type.
Reported-by: syzbot <syzbot+85992ace37d5b7b51635@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
---
drivers/iommu/iommufd/iova_bitmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c
index ab665cf38ef4..39a86a4a1d3a 100644
--- a/drivers/iommu/iommufd/iova_bitmap.c
+++ b/drivers/iommu/iommufd/iova_bitmap.c
@@ -130,7 +130,7 @@ struct iova_bitmap {
static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap,
unsigned long iova)
{
- unsigned long pgsize = 1 << bitmap->mapped.pgshift;
+ unsigned long pgsize = 1UL << bitmap->mapped.pgshift;
return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize);
}
--
2.39.5
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] iommu: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
2025-01-12 12:39 Qasim Ijaz
@ 2025-01-13 12:00 ` Joao Martins
2025-01-13 16:22 ` Jason Gunthorpe
0 siblings, 1 reply; 5+ messages in thread
From: Joao Martins @ 2025-01-13 12:00 UTC (permalink / raw)
To: Qasim Ijaz
Cc: iommu, linux-kernel, Jason Gunthorpe, Kevin Tian, Joerg Roedel,
Will Deacon, Robin Murphy
On 12/01/2025 12:39, Qasim Ijaz wrote:
> This patch resolves a UBSAN shift-out-of-bounds issue in
Avoid the 'this patch' e.g. Resolve a UBSAN shift-out-of-bonds (...)
The Subject component part could also be a bit more specific e.g.
iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
> iova_bitmap_offset_to_index() where shifting the constant "1" (of type int)
> by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior.
>
> The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63)
> the shift operation overflows, as the result cannot be represented in a 32-bit type.
>
> To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type
> to match the operand's type.
>
> Reported-by: syzbot <syzbot+85992ace37d5b7b51635@syzkaller.appspotmail.com>
> Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
> Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
With those two nits:
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
> ---
> drivers/iommu/iommufd/iova_bitmap.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c
> index ab665cf38ef4..39a86a4a1d3a 100644
> --- a/drivers/iommu/iommufd/iova_bitmap.c
> +++ b/drivers/iommu/iommufd/iova_bitmap.c
> @@ -130,7 +130,7 @@ struct iova_bitmap {
> static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap,
> unsigned long iova)
> {
> - unsigned long pgsize = 1 << bitmap->mapped.pgshift;
> + unsigned long pgsize = 1UL << bitmap->mapped.pgshift;
>
> return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize);
> }
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] iommu: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
2025-01-13 12:00 ` Joao Martins
@ 2025-01-13 16:22 ` Jason Gunthorpe
2025-01-13 16:25 ` Joao Martins
0 siblings, 1 reply; 5+ messages in thread
From: Jason Gunthorpe @ 2025-01-13 16:22 UTC (permalink / raw)
To: Joao Martins
Cc: Qasim Ijaz, iommu, linux-kernel, Kevin Tian, Joerg Roedel,
Will Deacon, Robin Murphy
On Mon, Jan 13, 2025 at 12:00:29PM +0000, Joao Martins wrote:
> On 12/01/2025 12:39, Qasim Ijaz wrote:
> > This patch resolves a UBSAN shift-out-of-bounds issue in
>
> Avoid the 'this patch' e.g. Resolve a UBSAN shift-out-of-bonds (...)
>
> The Subject component part could also be a bit more specific e.g.
>
> iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
>
> > iova_bitmap_offset_to_index() where shifting the constant "1" (of type int)
> > by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior.
> >
> > The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63)
> > the shift operation overflows, as the result cannot be represented in a 32-bit type.
> >
> > To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type
> > to match the operand's type.
> >
> > Reported-by: syzbot <syzbot+85992ace37d5b7b51635@syzkaller.appspotmail.com>
> > Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
> > Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
>
> With those two nits:
>
> Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
It needs a fixes line too
Jason
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] iommu: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
2025-01-13 16:22 ` Jason Gunthorpe
@ 2025-01-13 16:25 ` Joao Martins
0 siblings, 0 replies; 5+ messages in thread
From: Joao Martins @ 2025-01-13 16:25 UTC (permalink / raw)
To: Jason Gunthorpe
Cc: Qasim Ijaz, iommu, linux-kernel, Kevin Tian, Joerg Roedel,
Will Deacon, Robin Murphy
On 13/01/2025 16:22, Jason Gunthorpe wrote:
> On Mon, Jan 13, 2025 at 12:00:29PM +0000, Joao Martins wrote:
>> On 12/01/2025 12:39, Qasim Ijaz wrote:
>>> This patch resolves a UBSAN shift-out-of-bounds issue in
>>
>> Avoid the 'this patch' e.g. Resolve a UBSAN shift-out-of-bonds (...)
>>
>> The Subject component part could also be a bit more specific e.g.
>>
>> iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
>>
>>> iova_bitmap_offset_to_index() where shifting the constant "1" (of type int)
>>> by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior.
>>>
>>> The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63)
>>> the shift operation overflows, as the result cannot be represented in a 32-bit type.
>>>
>>> To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type
>>> to match the operand's type.
>>>
>>> Reported-by: syzbot <syzbot+85992ace37d5b7b51635@syzkaller.appspotmail.com>
>>> Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
>>> Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
>>
>> With those two nits:
>>
>> Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
>
> It needs a fixes line too
It should be
Fixes: 495c06d82ba ("vfio: Add an IOVA bitmap support")
Joao
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-01-13 22:45 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-01-13 22:45 [PATCH] iommu: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() Qasim Ijaz
-- strict thread matches above, loose matches on Subject: below --
2025-01-12 12:39 Qasim Ijaz
2025-01-13 12:00 ` Joao Martins
2025-01-13 16:22 ` Jason Gunthorpe
2025-01-13 16:25 ` Joao Martins
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox