diff options
| author | Qasim Ijaz <qasdev00@gmail.com> | 2025-01-13 22:38:20 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-02-08 09:57:51 +0100 |
| commit | d5d33f01b86af44b23eea61ee309e4ef22c0cdfe (patch) | |
| tree | 262e00f5b99e7061514b3a24dfaf10bfa51d04f7 | |
| parent | 5d679086873fe9a51354ceaddb8937ac589520d0 (diff) | |
| download | linux-d5d33f01b86af44b23eea61ee309e4ef22c0cdfe.tar.gz linux-d5d33f01b86af44b23eea61ee309e4ef22c0cdfe.tar.bz2 linux-d5d33f01b86af44b23eea61ee309e4ef22c0cdfe.zip | |
iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
[ Upstream commit e24c1551059268b37f6f40639883eafb281b8b9c ]
Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index()
where shifting the constant "1" (of type int) by bitmap->mapped.pgshift
(an unsigned long value) could result in undefined behavior.
The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds
31 (e.g., pgshift = 63) the shift operation overflows, as the result
cannot be represented in a 32-bit type.
To resolve this, the constant is updated to "1UL", promoting it to an
unsigned long type to match the operand's type.
Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support")
Link: https://patch.msgid.link/r/20250113223820.10713-1-qasdev00@gmail.com
Reported-by: syzbot <syzbot+85992ace37d5b7b51635@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/iommu/iommufd/iova_bitmap.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c index d90b9e253412..2cdc4f542df4 100644 --- a/drivers/iommu/iommufd/iova_bitmap.c +++ b/drivers/iommu/iommufd/iova_bitmap.c @@ -130,7 +130,7 @@ struct iova_bitmap { static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap, unsigned long iova) { - unsigned long pgsize = 1 << bitmap->mapped.pgshift; + unsigned long pgsize = 1UL << bitmap->mapped.pgshift; return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize); } |