linux-kernel - Re: [PATCH] iommu: Fix shift-out-of-bounds in iova_bitmap_offset_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Z4WXmeILAzTfb1xO@qasdev.system>
Date: Mon, 13 Jan 2025 22:45:45 +0000
From: Qasim Ijaz <qasdev00@...il.com>
To: Joao Martins <joao.m.martins@...cle.com>,
	Jason Gunthorpe <jgg@...pe.ca>
Cc: Kevin Tian <kevin.tian@...el.com>, Joerg Roedel <joro@...tes.org>,
	Will Deacon <will@...nel.org>, Robin Murphy <robin.murphy@....com>,
	iommu@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] iommu: Fix shift-out-of-bounds in
 iova_bitmap_offset_to_index()

On Mon, Jan 13, 2025 at 04:25:29PM +0000, Joao Martins wrote:
> On 13/01/2025 16:22, Jason Gunthorpe wrote:
> > On Mon, Jan 13, 2025 at 12:00:29PM +0000, Joao Martins wrote:
> >> On 12/01/2025 12:39, Qasim Ijaz wrote:
> >>> This patch resolves a UBSAN shift-out-of-bounds issue in 
> >>
> >> Avoid the 'this patch' e.g. Resolve a UBSAN shift-out-of-bonds (...)
> >>
> >> The Subject component part could also be a bit more specific e.g.
> >>
> >> iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
> >>
> >>> iova_bitmap_offset_to_index() where shifting the constant "1" (of type int) 
> >>> by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior. 
> >>>
> >>> The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63)
> >>> the shift operation overflows, as the result cannot be represented in a 32-bit type.
> >>>
> >>> To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type 
> >>> to match the operand's type.
> >>>
> >>> Reported-by: syzbot <syzbot+85992ace37d5b7b51635@...kaller.appspotmail.com>
> >>> Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
> >>> Signed-off-by: Qasim Ijaz <qasdev00@...il.com>
> >>
> >> With those two nits:
> >>
> >> 	Reviewed-by: Joao Martins <joao.m.martins@...cle.com>
> > 
> > It needs a fixes line too
> 
> It should be
> 
> Fixes: 495c06d82ba ("vfio: Add an IOVA bitmap support")
> 
>   Joao

Thank you for your feedback on the initial patch Jason and Joao. I’ve incorporated your suggestions and submitted a v2 patch for review.

Please let me know if further adjustments are needed.

Best regards,
Qasim