kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers/vfio
History
Qasim Ijaz 38ac76fc06 iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() 
[ Upstream commit e24c155105 ]

Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index()
where shifting the constant "1" (of type int) by bitmap->mapped.pgshift
(an unsigned long value) could result in undefined behavior.

The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds
31 (e.g., pgshift = 63) the shift operation overflows, as the result
cannot be represented in a 32-bit type.

To resolve this, the constant is updated to "1UL", promoting it to an
unsigned long type to match the operand's type.

Fixes: 58ccf0190d ("vfio: Add an IOVA bitmap support")
Link: https://patch.msgid.link/r/20250113223820.10713-1-qasdev00@gmail.com
Reported-by: syzbot <syzbot+85992ace37d5b7b51635@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-02-08 09:52:22 +01:00
..
cdx vfio/cdx: Remove redundant initialization owner in vfio_cdx_driver 2023-08-16 11:13:51 -06:00
fsl-mc vfio/fsl-mc: Block calling interrupt handler without trigger 2024-04-03 15:28:49 +02:00
mdev vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent() 2023-09-22 12:48:04 -06:00
pci vfio/mlx5: Align the page tracking max message size with the device capability 2024-12-14 20:00:20 +01:00
platform vfio/platform: check the bounds of read/write syscalls 2025-02-01 18:37:55 +01:00
container.c VFIO updates for v6.3-rc1 2023-02-25 11:52:57 -08:00
device_cdev.c vfio: Add VFIO_DEVICE_[AT|DE]TACH_IOMMUFD_PT 2023-07-25 10:20:37 -06:00
group.c vfio: Move the IOMMU_CAP_CACHE_COHERENCY check in __vfio_register_dev() 2023-07-25 10:20:41 -06:00
iommufd.c vfio: Support IO page table replacement 2023-07-28 13:31:24 -03:00
iova_bitmap.c iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() 2025-02-08 09:52:22 +01:00
Kconfig vfio: Compile vfio_group infrastructure optionally 2023-07-25 10:20:50 -06:00
Makefile vfio: Compile vfio_group infrastructure optionally 2023-07-25 10:20:50 -06:00
vfio.h vfio: Compile vfio_group infrastructure optionally 2023-07-25 10:20:50 -06:00
vfio_iommu_spapr_tce.c vfio/spapr: Always clear TCEs before unsetting the window 2024-09-12 11:11:31 +02:00
vfio_iommu_type1.c vfio: align capability structures 2023-08-17 12:17:44 -06:00
vfio_main.c iommufd for 6.6 2023-08-30 20:41:37 -07:00
virqfd.c vfio: Introduce interface to flush virqfd inject workqueue 2024-04-03 15:28:49 +02:00