On 29/07/2026 1:07 pm, Sebastian Brzezinka wrote:
Hi,
On Thu Jul 23, 2026 at 12:25 PM CEST, Krzysztof Karas wrote:
It is possible, when a very large mapping uses only one
scatterlist, that padding overflows scatterlist's length field.
This results in:
1) silently wrapping the value
2) smaller than desired mappings produced by iommu_map_sg
3) leaving mapped bytes in memory (no iommu_unmap)
Address this issue by adding overflow detection for scatterlist
length field.
Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
Signed-off-by: Krzysztof Karas <[email protected]>
Reviewed-by: Robin Murphy <[email protected]>
---
v4:
* Added value wrap check before s->length assignment (Robin);
drivers/iommu/dma-iommu.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 381b60d9e7ce..3ca3196a41b0 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -21,6 +21,7 @@
#include <linux/iommu-dma.h>
#include <linux/iova.h>
#include <linux/irq.h>
+#include <linux/limits.h>
#include <linux/list_sort.h>
#include <linux/memremap.h>
#include <linux/mm.h>
@@ -1477,6 +1478,12 @@ int iommu_dma_map_sg(struct device *dev, struct
scatterlist *sg, int nents,
sg_dma_len(s) = s_length;
s->offset -= s_iova_off;
s_length = iova_align(iovad, s_length + s_iova_off);
+ if ((s_length & UINT_MAX) == 0) {
Might be better to go with s_length > UINT_MAX . Right now it's 64 &
32, so only the lower bits count. Or just ignore this comment it if
it's intended.
Yes, this code also needs to support 32-bit size_t, wherein the overflow
already happens within the calculation of s_length itself.
Thanks,
Robin.
