From: Niklas Schnelle <schnelle@linux.ibm.com> To: Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org> Cc: Christoph Hellwig <hch@lst.de>, Jason Gunthorpe <jgg@nvidia.com>, Robin Murphy <robin.murphy@arm.com>, Matthew Rosato <mjrosato@linux.ibm.com>, linux-kernel@vger.kernel.org, iommu@lists.linux-foundation.org Subject: [PATCH] iommu/dma: Fix check for error return from iommu_map_sg_atomic() Date: Fri, 13 May 2022 17:39:48 +0200 [thread overview] Message-ID: <20220513153948.310119-1-schnelle@linux.ibm.com> (raw) In __iommu_dma_alloc_noncontiguous() the value returned by iommu_map_sg_atomic() is checked for being smaller than size. Before commit ad8f36e4b6b1 ("iommu: return full error code from iommu_map_sg[_atomic]()") this simply checked if the requested size was successfully mapped. After that commit iommu_map_sg_atomic() may also return a negative error value. In principle this too would be covered by the existing check. There is one problem however, as size is of type size_t while the return type of iommu_map_sg_atomic() is now of type ssize_t the latter gets converted to size_t and negative error values end up as very large positive values making the check succeed. Fix this by making the return type visible with a local variable and add an explicit cast to ssize_t. Fixes: ad8f36e4b6b1 ("iommu: return full error code from iommu_map_sg[_atomic]()") Cc: stable@vger.kernel.org Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> --- drivers/iommu/dma-iommu.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 09f6e1c0f9c0..b4fcf1d92994 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -776,6 +776,7 @@ static struct page **__iommu_dma_alloc_noncontiguous(struct device *dev, unsigned int count, min_size, alloc_sizes = domain->pgsize_bitmap; struct page **pages; dma_addr_t iova; + ssize_t mapped; if (static_branch_unlikely(&iommu_deferred_attach_enabled) && iommu_deferred_attach(dev, domain)) @@ -813,8 +814,8 @@ static struct page **__iommu_dma_alloc_noncontiguous(struct device *dev, arch_dma_prep_coherent(sg_page(sg), sg->length); } - if (iommu_map_sg_atomic(domain, iova, sgt->sgl, sgt->orig_nents, ioprot) - < size) + mapped = iommu_map_sg_atomic(domain, iova, sgt->sgl, sgt->orig_nents, ioprot); + if (mapped < (ssize_t)size) goto out_free_sg; sgt->sgl->dma_address = iova; -- 2.32.0
WARNING: multiple messages have this Message-ID (diff)
From: Niklas Schnelle <schnelle@linux.ibm.com> To: Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org> Cc: linux-kernel@vger.kernel.org, iommu@lists.linux-foundation.org, Jason Gunthorpe <jgg@nvidia.com>, Robin Murphy <robin.murphy@arm.com>, Christoph Hellwig <hch@lst.de> Subject: [PATCH] iommu/dma: Fix check for error return from iommu_map_sg_atomic() Date: Fri, 13 May 2022 17:39:48 +0200 [thread overview] Message-ID: <20220513153948.310119-1-schnelle@linux.ibm.com> (raw) In __iommu_dma_alloc_noncontiguous() the value returned by iommu_map_sg_atomic() is checked for being smaller than size. Before commit ad8f36e4b6b1 ("iommu: return full error code from iommu_map_sg[_atomic]()") this simply checked if the requested size was successfully mapped. After that commit iommu_map_sg_atomic() may also return a negative error value. In principle this too would be covered by the existing check. There is one problem however, as size is of type size_t while the return type of iommu_map_sg_atomic() is now of type ssize_t the latter gets converted to size_t and negative error values end up as very large positive values making the check succeed. Fix this by making the return type visible with a local variable and add an explicit cast to ssize_t. Fixes: ad8f36e4b6b1 ("iommu: return full error code from iommu_map_sg[_atomic]()") Cc: stable@vger.kernel.org Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> --- drivers/iommu/dma-iommu.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 09f6e1c0f9c0..b4fcf1d92994 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -776,6 +776,7 @@ static struct page **__iommu_dma_alloc_noncontiguous(struct device *dev, unsigned int count, min_size, alloc_sizes = domain->pgsize_bitmap; struct page **pages; dma_addr_t iova; + ssize_t mapped; if (static_branch_unlikely(&iommu_deferred_attach_enabled) && iommu_deferred_attach(dev, domain)) @@ -813,8 +814,8 @@ static struct page **__iommu_dma_alloc_noncontiguous(struct device *dev, arch_dma_prep_coherent(sg_page(sg), sg->length); } - if (iommu_map_sg_atomic(domain, iova, sgt->sgl, sgt->orig_nents, ioprot) - < size) + mapped = iommu_map_sg_atomic(domain, iova, sgt->sgl, sgt->orig_nents, ioprot); + if (mapped < (ssize_t)size) goto out_free_sg; sgt->sgl->dma_address = iova; -- 2.32.0 _______________________________________________ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu
next reply other threads:[~2022-05-13 15:40 UTC|newest] Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-05-13 15:39 Niklas Schnelle [this message] 2022-05-13 15:39 ` [PATCH] iommu/dma: Fix check for error return from iommu_map_sg_atomic() Niklas Schnelle 2022-05-17 8:36 ` Christoph Hellwig 2022-05-17 8:36 ` Christoph Hellwig 2022-05-17 10:17 ` Niklas Schnelle 2022-05-17 10:17 ` Niklas Schnelle 2022-05-17 10:18 ` Robin Murphy 2022-05-17 10:18 ` Robin Murphy 2022-05-17 10:32 ` Niklas Schnelle 2022-05-17 10:32 ` Niklas Schnelle
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220513153948.310119-1-schnelle@linux.ibm.com \ --to=schnelle@linux.ibm.com \ --cc=hch@lst.de \ --cc=iommu@lists.linux-foundation.org \ --cc=jgg@nvidia.com \ --cc=joro@8bytes.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mjrosato@linux.ibm.com \ --cc=robin.murphy@arm.com \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.