Hi,
On Thu Jul 23, 2026 at 12:25 PM CEST, Krzysztof Karas wrote:
> It is possible, when a very large mapping uses only one
> scatterlist, that padding overflows scatterlist's length field.
> This results in:
> 1) silently wrapping the value
> 2) smaller than desired mappings produced by iommu_map_sg
> 3) leaving mapped bytes in memory (no iommu_unmap)
>
> Address this issue by adding overflow detection for scatterlist
> length field.
>
> Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
> Signed-off-by: Krzysztof Karas <[email protected]>
> Reviewed-by: Robin Murphy <[email protected]>
> ---
> v4:
> * Added value wrap check before s->length assignment (Robin);
>
> drivers/iommu/dma-iommu.c | 20 +++++++++++++++++++-
> 1 file changed, 19 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
> index 381b60d9e7ce..3ca3196a41b0 100644
> --- a/drivers/iommu/dma-iommu.c
> +++ b/drivers/iommu/dma-iommu.c
> @@ -21,6 +21,7 @@
> #include <linux/iommu-dma.h>
> #include <linux/iova.h>
> #include <linux/irq.h>
> +#include <linux/limits.h>
> #include <linux/list_sort.h>
> #include <linux/memremap.h>
> #include <linux/mm.h>
> @@ -1477,6 +1478,12 @@ int iommu_dma_map_sg(struct device *dev, struct
> scatterlist *sg, int nents,
> sg_dma_len(s) = s_length;
> s->offset -= s_iova_off;
> s_length = iova_align(iovad, s_length + s_iova_off);
> + if ((s_length & UINT_MAX) == 0) {
Might be better to go with s_length > UINT_MAX . Right now it's 64 &
32, so only the lower bits count. Or just ignore this comment it if
it's intended.
--
Best regards,
Sebastian
