Jason Gunthorpe e42a046bb4 iommufd: Prevent ALIGN() overflow ...

commit b42497e3c0 upstream.

When allocating IOVA the candidate range gets aligned to the target
alignment. If the range is close to ULONG_MAX then the ALIGN() can
wrap resulting in a corrupted iova.

Open code the ALIGN() using get_add_overflow() to prevent this.
This simplifies the checks as we don't need to check for length earlier
either.

Consolidate the two copies of this code under a single helper.

This bug would allow userspace to create a mapping that overlaps with some
other mapping or a reserved range.

Cc: stable@vger.kernel.org
Fixes: 51fe6141f0 ("iommufd: Data structure to provide IOVA to PFN mapping")
Reported-by: syzbot+c2f65e2801743ca64e08@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/685af644.a00a0220.2e5631.0094.GAE@google.com
Reviewed-by: Yi Liu <yi.l.liu@intel.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Link: https://patch.msgid.link/all/1-v1-7b4a16fc390b+10f4-iommufd_alloc_overflow_jgg@nvidia.com/
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-08-20 18:36:29 +02:00

..

amd

iommu/amd: Fix geometry.aperture_end for V2 tables

2025-08-15 12:16:32 +02:00

arm

iommu/arm-smmu-qcom: Add SM6115 MDSS compatible

2025-08-20 18:36:28 +02:00

intel

iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes

2025-08-20 18:36:28 +02:00

iommufd

iommufd: Prevent ALIGN() overflow

2025-08-20 18:36:29 +02:00

riscv

iommu/riscv: Fixup compile warning

2025-01-17 08:58:06 +01:00

apple-dart.c

iommu: apple-dart: fix potential null pointer deref

2025-03-20 08:59:15 +01:00

dma-iommu.c

iommu: remove unneeded semicolon

2025-04-11 12:43:06 +02:00

dma-iommu.h

iommu: Drop sw_msi from iommu_domain

2025-03-25 10:18:19 -03:00

exynos-iommu.c

iommu/exynos: Fix suspend/resume with IDENTITY domain

2025-04-11 12:40:41 +02:00

fsl_pamu_domain.c

iommu: Use of_property_present()

2024-09-04 11:31:01 +02:00

fsl_pamu_domain.h

…

fsl_pamu.c

iommu/fsl: fix all kernel-doc warnings in fsl_pamu.c

2023-03-22 14:50:15 +01:00

fsl_pamu.h

…

hyperv-iommu.c

hyperv: Log hypercall status codes as strings

2025-03-20 21:23:03 +00:00

io-pgfault.c

iommu: Fix potential memory leak in iopf_queue_remove_device()

2025-02-10 14:49:30 +01:00

io-pgtable-arm-v7s.c

iommu/io-pgtable-arm-v7s: Remove split on unmap behavior

2024-11-06 15:42:36 +00:00

io-pgtable-arm.c

iommu/io-pgtable-arm: dynamically allocate selftest device struct

2025-06-19 15:39:47 +02:00

io-pgtable-arm.h

…

io-pgtable-dart.c

iommu/io-pgtable-dart: Only set subpage protection disable for DART 1

2025-02-21 12:06:54 +01:00

io-pgtable.c

iommu: Allow passing custom allocators to pgtable drivers

2023-11-27 11:10:12 +01:00

iommu-debugfs.c

…

iommu-pages.h

iommu: account IOMMU allocated memory

2024-04-15 14:31:48 +02:00

iommu-priv.h

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

2025-04-01 18:03:46 -07:00

iommu-sva.c

iommu: Sort out domain user data

2025-03-25 10:18:18 -03:00

iommu-sysfs.c

iommu/sysfs: constify the class struct

2024-10-29 09:50:24 +01:00

iommu-traces.c

iommu: Remove detach_dev callback

2023-01-13 16:39:18 +01:00

iommu.c

iommu: Allow attaching static domains in iommu_attach_device_pasid()

2025-06-27 11:13:06 +01:00

iova.c

Merge tag 'mm-stable-2024-11-18-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-11-23 09:58:07 -08:00

ipmmu-vmsa.c

iommu: ipmmu-vmsa: avoid Wformat-security warning

2025-06-19 15:39:46 +02:00

irq_remapping.c

Merge tag 'iommu-updates-v6.10' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

2024-05-18 10:55:13 -07:00

irq_remapping.h

iommu/vt-d: Allocate DMAR fault interrupts locally

2024-04-26 11:57:36 +02:00

Kconfig

iommu: remove duplicate selection of DMAR_TABLE

2025-06-19 15:39:54 +02:00

Makefile

iommu/riscv: Add RISC-V IOMMU platform device driver

2024-10-29 09:46:23 +01:00

msm_iommu_hw-8xxx.h

…

msm_iommu.c

iommu/msm: Use helper function devm_clk_get_prepared()

2025-01-06 12:41:00 +01:00

msm_iommu.h

…

mtk_iommu_v1.c

iommu/mediatek-v1: Support COMPILE_TEST

2025-03-13 12:17:30 +01:00

mtk_iommu.c

iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group

2025-04-11 12:40:55 +02:00

of_iommu.c

iommu: Get DT/ACPI parsing into the proper probe path

2025-03-11 14:05:43 +01:00

omap-iommu-debug.c

iommu/omap: Fix buffer overflow in debugfs

2022-09-07 10:42:28 +02:00

omap-iommu.c

Get rid of 'remove_new' relic from platform driver struct

2024-12-01 15:12:43 -08:00

omap-iommu.h

iommu/omap: Convert to generic_single_device_group()

2023-09-25 11:52:08 +02:00

omap-iopgtable.h

…

rockchip-iommu.c

iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU

2025-07-10 16:08:53 +02:00

s390-iommu.c

iommu/s390: implement iommu passthrough via identity domain

2025-02-21 12:02:00 +01:00

sprd-iommu.c

Get rid of 'remove_new' relic from platform driver struct

2024-12-01 15:12:43 -08:00

sun50i-iommu.c

iommu: sun50i: Add H616 compatible string

2024-06-25 14:02:47 +02:00

tegra-smmu.c

iommu: Unexport iommu_fwspec_free()

2025-03-11 14:05:39 +01:00

virtio-iommu.c

virtio: rename virtio_find_vqs_info() to virtio_find_vqs()

2024-07-17 05:20:58 -04:00