Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] iommu/dma: missed scatterlist length overflow on 32-bit architectures --
commit c8808dcafa857db06b75cf791820b2414095b3cc Author: Krzysztof Karas <[email protected]> iommu/dma: Catch scatterlist length overflows It is possible, when a very large mapping uses only one scatterlist, that padding overflows scatterlist's length field. Address this issue by adding overflow detection for scatterlist length field. > diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c > index 58c624513cd43..06edb4056dc1b 100644 > --- a/drivers/iommu/dma-iommu.c > +++ b/drivers/iommu/dma-iommu.c > @@ -1477,6 +1477,11 @@ int iommu_dma_map_sg(struct device *dev, struct > scatterlist *sg, int nents, > sg_dma_len(s) = s_length; > s->offset -= s_iova_off; > s_length = iova_align(iovad, s_length + s_iova_off); > + if (overflows_type(s_length, s->length)) { > + ret = -EOVERFLOW; > + > + goto out_restore_sg; > + } [Severity: Medium] Does this catch scatterlist length wrapping on 32-bit architectures? If a caller provides a scatterlist segment with a length close to 4GB on a 32-bit system, s_length and s_iova_off are both size_t. Their addition and the subsequent iova_align() will silently wrap around in 32-bit arithmetic before the overflows_type() check is reached. Because s_length has already wrapped, overflows_type() will evaluate if the wrapped 32-bit value fits inside a 32-bit unsigned int (s->length), which always returns false. In contrast, the subsequent pad_len check correctly uses check_add_overflow(), avoiding this pitfall. Could a similar approach be used here? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
