mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-28 00:35:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

vhost/vdpa: reject overflowing PA map page counts on 32-bit

Browse Source 
vhost_vdpa_pa_map() adds the IOVA page offset to the user-controlled map
size before computing the number of pages to pin. On 32-bit systems,
where unsigned long is narrower than u64, that addition can overflow and
the code can pin and map fewer pages than the requested IOTLB range.

Reject sizes that overflow the unsigned long page-count calculation.

Fixes: 22af48cf91 ("vdpa: factor out vhost_vdpa_pa_map() and vhost_vdpa_pa_unmap()")
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <CAMuQ4bX-iDvcUOPPY+NLz95tkRJYwWqvzAr=U48uNaub_HZLGw@mail.gmail.com>
This commit is contained in:
Yousef Alhouseen
2026-06-24 15:02:02 -07:00
committed by Michael S. Tsirkin
parent 1ed35ac7f3
commit 0619aaa34c
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/vhost/vdpa.c
View File

@@ -1109,6 +1109,7 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v,
unsigned int gup_flags = FOLL_LONGTERM;
unsigned long npages, cur_base, map_pfn, last_pfn = 0;
unsigned long lock_limit, sz2pin, nchunks, i;
unsigned long page_offset;
u64 start = iova;
long pinned;
int ret = 0;
@@ -1121,7 +1122,13 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v,
if (perm & VHOST_ACCESS_WO)
gup_flags |= FOLL_WRITE;
npages = PFN_UP(size + (iova & ~PAGE_MASK));
page_offset = iova & ~PAGE_MASK;
if (size > ULONG_MAX - page_offset) {
ret = -EINVAL;
goto free;
}
npages = PFN_UP(size + page_offset);
if (!npages) {
ret = -EINVAL;
goto free;