linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Nicolin Chen <nicoleotsuka@gmail.com>,
	Robin Murphy <robin.murphy@arm.com>,
	Joerg Roedel <jroedel@suse.de>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 03/57] iommu/dma: Handle SG length overflow better
Date: Wed,  4 Sep 2019 19:53:31 +0200	[thread overview]
Message-ID: <20190904175302.277844145@linuxfoundation.org> (raw)
In-Reply-To: <20190904175301.777414715@linuxfoundation.org>

[ Upstream commit ab2cbeb0ed301a9f0460078e91b09f39958212ef ]

Since scatterlist dimensions are all unsigned ints, in the relatively
rare cases where a device's max_segment_size is set to UINT_MAX, then
the "cur_len + s_length <= max_len" check in __finalise_sg() will always
return true. As a result, the corner case of such a device mapping an
excessively large scatterlist which is mergeable to or beyond a total
length of 4GB can lead to overflow and a bogus truncated dma_length in
the resulting segment.

As we already assume that any single segment must be no longer than
max_len to begin with, this can easily be addressed by reshuffling the
comparison.

Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
Reported-by: Nicolin Chen <nicoleotsuka@gmail.com>
Tested-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/dma-iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 9d1cebe7f6cbb..c87764a4e2126 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -684,7 +684,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
 		 * - and wouldn't make the resulting output segment too long
 		 */
 		if (cur_len && !s_iova_off && (dma_addr & seg_mask) &&
-		    (cur_len + s_length <= max_len)) {
+		    (max_len - cur_len >= s_length)) {
 			/* ...then concatenate it with the previous one */
 			cur_len += s_length;
 		} else {
-- 
2.20.1




  parent reply	other threads:[~2019-09-04 18:03 UTC|newest]

Thread overview: 66+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-04 17:53 [PATCH 4.14 00/57] 4.14.142-stable review Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 01/57] dmaengine: ste_dma40: fix unneeded variable warning Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 02/57] auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach Greg Kroah-Hartman
2019-09-04 17:53 ` Greg Kroah-Hartman [this message]
2019-09-04 17:53 ` [PATCH 4.14 04/57] usb: gadget: composite: Clear "suspended" on reset/disconnect Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 05/57] usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 06/57] xen/blkback: fix memory leaks Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 07/57] i2c: rcar: avoid race when unregistering slave client Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 08/57] i2c: emev2: " Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 09/57] drm/ast: Fixed reboot test may cause system hanged Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 10/57] usb: host: fotg2: restart hcd after port reset Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 11/57] tools: hv: fix KVP and VSS daemons exit code Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 12/57] watchdog: bcm2835_wdt: Fix module autoload Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 13/57] drm/bridge: tfp410: fix memleak in get_modes() Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 14/57] scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 15/57] drm/tilcdc: Register cpufreq notifier after we have initialized crtc Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 16/57] tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 17/57] ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 18/57] ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 19/57] net/smc: make sure EPOLLOUT is raised Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 20/57] tcp: make sure EPOLLOUT wont be missed Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 21/57] mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 22/57] ALSA: line6: Fix memory leak at line6_init_pcm() error path Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 23/57] ALSA: seq: Fix potential concurrent access to the deleted pool Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 24/57] kvm: x86: skip populating logical dest map if apic is not sw enabled Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 25/57] KVM: x86: Dont update RIP or do single-step on faulting emulation Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 26/57] x86/apic: Do not initialize LDR and DFR for bigsmp Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 27/57] x86/apic: Include the LDR when clearing out APIC registers Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 28/57] ftrace: Fix NULL pointer dereference in t_probe_next() Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 29/57] ftrace: Check for successful allocation of hash Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 30/57] ftrace: Check for empty hash and comment the race with registering probes Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 31/57] usb-storage: Add new JMS567 revision to unusual_devs Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 32/57] USB: cdc-wdm: fix race between write and disconnect due to flag abuse Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 33/57] usb: chipidea: udc: dont do hardware access if gadget has stopped Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 34/57] usb: host: ohci: fix a race condition between shutdown and irq Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 35/57] usb: host: xhci: rcar: Fix typo in compatible string matching Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 36/57] USB: storage: ums-realtek: Update module parameter description for auto_delink_en Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 37/57] USB: storage: ums-realtek: Whitelist auto-delink support Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 38/57] uprobes/x86: Fix detection of 32-bit user mode Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 39/57] mmc: sdhci-of-at91: add quirk for broken HS200 Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 40/57] mmc: core: Fix init of SD cards reporting an invalid VDD range Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 41/57] stm class: Fix a double free of stm_source_device Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 42/57] intel_th: pci: Add support for another Lewisburg PCH Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 43/57] intel_th: pci: Add Tiger Lake support Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 44/57] drm/i915: Dont deballoon unused ggtt drm_mm_node in linux guest Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 45/57] VMCI: Release resource if the work is already queued Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 46/57] crypto: ccp - Ignore unconfigured CCP device on suspend/resume Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 47/57] Revert "cfg80211: fix processing world regdomain when non modular" Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 48/57] mac80211: fix possible sta leak Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 49/57] KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 50/57] KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 51/57] KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 52/57] NFS: Clean up list moves of struct nfs_page Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 53/57] NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend() Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 54/57] NFS: Pass error information to the pgio error cleanup routine Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 55/57] NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0 Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 56/57] i2c: piix4: Fix port selection for AMD Family 16h Model 30h Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 57/57] x86/ptrace: fix up botched merge of spectrev1 fix Greg Kroah-Hartman
2019-09-05  0:18 ` [PATCH 4.14 00/57] 4.14.142-stable review kernelci.org bot
2019-09-05  0:38   ` Kevin Hilman
2019-09-05  3:48     ` Guenter Roeck
2019-09-05 14:42 ` shuah
2019-09-05 16:55 ` Guenter Roeck
2019-09-05 17:27 ` Daniel Díaz
2019-09-05 19:52 ` Kelsey Skunberg
2019-09-06  7:36 ` Jon Hunter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190904175302.277844145@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=jroedel@suse.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nicoleotsuka@gmail.com \
    --cc=robin.murphy@arm.com \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).