diff options
| author | Shivaprasad G Bhat <sbhat@linux.ibm.com> | 2026-09-15 22:04:17 +0530 |
|---|---|---|
| committer | Madhavan Srinivasan <maddy@linux.ibm.com> | 2026-09-16 13:43:58 +0530 |
| commit | 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71 (patch) | |
| tree | affdb13250d05eff52a66920b8040368647797a2 /scripts/Makefile.thinlto | |
| parent | 0a416ee20bcccddf91ca5b63696a23b9d11d73aa (diff) | |
| download | linux-stable-0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71.tar.gz linux-stable-0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71.zip | |
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified
IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba().
While doing so, the passed in argument npages is ignored and constant
value '1' is used leaving out a possible overflow as the callers can
legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT
cases.
Fix this by accounting for 'npages', checking for arithmetic overflow,
and verifying that the entire requested range (ioba - offset + npages)
does not exceed the table capacity 'size'.
Fixes: b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking")
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Diffstat (limited to 'scripts/Makefile.thinlto')
0 files changed, 0 insertions, 0 deletions