superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

iommu/io-pgtable-dart: Fix off by one error in table index check 

The check for the dart table index allowed values of
(1 << data->tbl_bits) while only as many entries are initialized in
apple_dart_alloc_pgtable. This results in an array out of bounds access
when data->tbl_bits is at its maximal value of 2. When data->tbl_bits is
0 or 1 an unset (initialized to zero) data->pgd[] entry is used. In both
cases the value is used as pointer to read page table entries and
results in dereferencing invalid pointers.
There is no prior check that the passed iova is inside the iommu's IAS
so invalid values can be passed from driver's calling iommu_map().

Fixes: 74a0e72f03 ("iommu/io-pgtable-dart: Add 4-level page table support")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/asahi/aMACFlJjrZHs_Yf-@stanley.mountain/
Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
pull/1354/merge
Janne Grunau 2025-09-09 13:54:43 +02:00 committed by Joerg Roedel
parent ecf6508923
commit a2d2e6ea18
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/iommu/io-pgtable-dart.c
View File

@ -177,7 +177,7 @@ static dart_iopte *dart_get_last(struct dart_io_pgtable *data, unsigned long iov
int level = data->levels;
int tbl = dart_get_index(data, iova, level);
if (tbl > (1 << data->tbl_bits))
if (tbl >= (1 << data->tbl_bits))
return NULL;
ptep = data->pgd[tbl];
@ -246,7 +246,7 @@ static int dart_map_pages(struct io_pgtable_ops *ops, unsigned long iova,
tbl = dart_get_index(data, iova, level);
if (tbl > (1 << data->tbl_bits))
if (tbl >= (1 << data->tbl_bits))
return -ENOMEM;
ptep = data->pgd[tbl];