Yousef Alhouseen 0619aaa34c vhost/vdpa: reject overflowing PA map page counts on 32-bit ...

vhost_vdpa_pa_map() adds the IOVA page offset to the user-controlled map
size before computing the number of pages to pin. On 32-bit systems,
where unsigned long is narrower than u64, that addition can overflow and
the code can pin and map fewer pages than the requested IOTLB range.

Reject sizes that overflow the unsigned long page-count calculation.

Fixes: 22af48cf91 ("vdpa: factor out vhost_vdpa_pa_map() and vhost_vdpa_pa_unmap()")
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <CAMuQ4bX-iDvcUOPPY+NLz95tkRJYwWqvzAr=U48uNaub_HZLGw@mail.gmail.com>

2026-08-03 15:21:54 -04:00

..

iotlb.c

vhost_iotlb: bound map allocation in add_range

2026-08-03 15:21:54 -04:00

Kconfig

vhost: Reintroduce kthread API and add mode selection

2025-08-01 09:11:09 -04:00

Makefile

vhost: introduce vDPA-based backend

2020-04-02 10:41:40 -04:00

net.c

Revert "vhost-net: wake queue of tun/tap after ptr_ring consume"

2026-07-29 17:12:27 -07:00

scsi.c

scsi: vhost-scsi: Report direction completion support

2026-02-28 21:04:03 -05:00

test.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

test.h

tools/virtio: Add --reset

2020-06-22 12:34:21 -04:00

vdpa.c

vhost/vdpa: reject overflowing PA map page counts on 32-bit

2026-08-03 15:21:54 -04:00

vhost.c

vhost_iotlb: bound map allocation in add_range

2026-08-03 15:21:54 -04:00

vhost.h

kcov: refactor common handle ID into kcov_common_handle_id

2026-05-28 21:24:45 -07:00

vringh.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

vsock.c

vhost/vsock: Refuse the connection immediately when guest isn't ready

2026-06-10 02:14:01 -04:00