It is possible, when a very large mapping uses only one
scatterlist, that padding overflows scatterlist's length field.
This results in:
1) silently wrapping the value
2) smaller than desired mappings produced by iommu_map_sg
3) leaving mapped bytes in memory (no iommu_unmap)
Address this issue by adding overflow detection for scatterlist
length field.
Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
Cc: [email protected]
Assisted-by: GitHub Copilot:claude-opus-5
Signed-off-by: Krzysztof Karas <[email protected]>
---
v6:
* dropped overflow checks on s_length + s_iova_off and removed
s_length_tmp variable along with
s_length_tmp != 0 && s_length == 0 test(Robin);
* dropped useless limits.h include;
* addedd Fixes tag and CC to linux stable;
* ran final checks with Claude Opus and added a tag.
drivers/iommu/dma-iommu.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 58c624513cd4..05cfd51016e6 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -1477,6 +1477,10 @@ int iommu_dma_map_sg(struct device *dev, struct
scatterlist *sg, int nents,
sg_dma_len(s) = s_length;
s->offset -= s_iova_off;
s_length = iova_align(iovad, s_length + s_iova_off);
+ if (overflows_type(s_length, s->length)) {
+ ret = -EOVERFLOW;
+ goto out_restore_sg;
+ }
s->length = s_length;
/*
@@ -1493,7 +1497,18 @@ int iommu_dma_map_sg(struct device *dev, struct
scatterlist *sg, int nents,
* time through here (i.e. before it has a meaningful value).
*/
if (pad_len && pad_len < s_length - 1) {
- prev->length += pad_len;
+ unsigned int new_prev_len;
+ /*
+ * For large mappings spanning multiple GBs we
+ * may not be able to fit all needed padding into
+ * sg->length.
+ */
+ if (check_add_overflow(prev->length, pad_len,
&new_prev_len)) {
+ ret = -EOVERFLOW;
+ goto out_restore_sg;
+ }
+
+ prev->length = new_prev_len;
iova_len += pad_len;
}
--
2.34.1
