linux-kernel - Re: [PATCH] iommu/dma: Fix iova map result check bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220508160115.4851-1-miles.chen@mediatek.com>
Date:   Mon, 9 May 2022 00:01:15 +0800
From:   Miles Chen <miles.chen@...iatek.com>
To:     <yf.wang@...iatek.com>
CC:     <Libo.Kang@...iatek.com>, <Ning.Li@...iatek.com>,
        <iommu@...ts.linux-foundation.org>, <joro@...tes.org>,
        <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>,
        <linux-mediatek@...ts.infradead.org>, <logang@...tatee.com>,
        <matthias.bgg@...il.com>, <stable@...r.kernel.org>,
        <will@...nel.org>, <wsd_upstream@...iatek.com>,
        <yong.wu@...iatek.com>
Subject: Re: [PATCH] iommu/dma: Fix iova map result check bug

> The data type of the return value of the iommu_map_sg_atomic
> is ssize_t, but the data type of iova size is size_t,
> e.g. one is int while the other is unsigned int.
> 
> When iommu_map_sg_atomic return value is compared with iova size,
> it will force the signed int to be converted to unsigned int, if
> iova map fails and iommu_map_sg_atomic return error code is less
> than 0, then (ret < iova_len) is false, which will to cause not
> do free iova, and the master can still successfully get the iova
> of map fail, which is not expected.
> 
> Therefore, we need to check the return value of iommu_map_sg_atomic
> in two cases according to whether it is less than 0.
> 
> Fixes: ad8f36e4b6b1 ("iommu: return full error code from iommu_map_sg[_atomic]()")
> Signed-off-by: Yunfei Wang <yf.wang@...iatek.com>

Yes, we have to make sure ssize_t >= 0 before comparing ssize_t and size_t.

Reviewed-by: Miles Chen <miles.chen@...iatek.com> 
>
> Cc: <stable@...r.kernel.org> # 5.15.*