Hi Krzysztof,
On Fri Oct 2, 2026 at 7:33 AM CEST, Krzysztof Karas wrote:
> It is possible, when a very large mapping uses only one
> scatterlist, that padding overflows scatterlist's length field.
> This results in:
> 1) silently wrapping the value
> 2) smaller than desired mappings produced by iommu_map_sg
> 3) leaving mapped bytes in memory (no iommu_unmap)
>
> Address this issue by adding overflow detection for scatterlist
> length field.
>
> Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Krzysztof Karas <[email protected]>
> Reviewed-by: Robin Murphy <[email protected]>
> ---
Reviewed-by: Sebastian Brzezinka <[email protected]>
--
Best regards,
Sebastian
