Re: [PATCH] iommu: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()

From: Joao Martins
Date: Mon Jan 13 2025 - 07:00:59 EST


On 12/01/2025 12:39, Qasim Ijaz wrote:
> This patch resolves a UBSAN shift-out-of-bounds issue in

Avoid the 'this patch' e.g. Resolve a UBSAN shift-out-of-bonds (...)

The Subject component part could also be a bit more specific e.g.

iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()

> iova_bitmap_offset_to_index() where shifting the constant "1" (of type int)
> by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior.
>
> The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63)
> the shift operation overflows, as the result cannot be represented in a 32-bit type.
>
> To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type
> to match the operand's type.
>
> Reported-by: syzbot <syzbot+85992ace37d5b7b51635@xxxxxxxxxxxxxxxxxxxxxxxxx>
> Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
> Signed-off-by: Qasim Ijaz <qasdev00@xxxxxxxxx>

With those two nits:

Reviewed-by: Joao Martins <joao.m.martins@xxxxxxxxxx>


> ---
> drivers/iommu/iommufd/iova_bitmap.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c
> index ab665cf38ef4..39a86a4a1d3a 100644
> --- a/drivers/iommu/iommufd/iova_bitmap.c
> +++ b/drivers/iommu/iommufd/iova_bitmap.c
> @@ -130,7 +130,7 @@ struct iova_bitmap {
> static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap,
> unsigned long iova)
> {
> - unsigned long pgsize = 1 << bitmap->mapped.pgshift;
> + unsigned long pgsize = 1UL << bitmap->mapped.pgshift;
>
> return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize);
> }