From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from fout-a2-smtp.messagingengine.com (fout-a2-smtp.messagingengine.com [103.168.172.145]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D7FEC27145F; Wed, 26 Nov 2025 18:55:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=103.168.172.145 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764183316; cv=none; b=pK2yXCCerdnzd2hlhIdyiXSRmYJM7dh1XUbFICfiabsX6z+DXUtSI1sXKwW0ZBS0TKUuNmvL+HybK4mtGKbFCAAlxMD1qhhzmuqArghhbq7aS46MKihce6tWUp5e8zeXd6TYhebYnFlAUeS5ohEASssQ0lF/UA6uZieejZDXl60= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764183316; c=relaxed/simple; bh=cASdTExdPNuBvanxWuvzcpbQmZP4m5w4/7AAw8cC9hk=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=HpC9xubsR/xkeosb0by6/S0SSiGgOj1bKRL50lhkkgMAQNhtipt6+lbYC5U7gKwUFRJu8YH6M++OlOv1y8On4Uq3mBohKuaagOPs/dv49OmfUuumpXk2jn45iTDDiVjQoOcar8WywINZ7HWIaWkOdn1Ir163aGb37B0gwptLUhc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=shazbot.org; spf=pass smtp.mailfrom=shazbot.org; dkim=pass (2048-bit key) header.d=shazbot.org header.i=@shazbot.org header.b=yg+RF1cb; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=Z38yM0Tx; arc=none smtp.client-ip=103.168.172.145 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=shazbot.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=shazbot.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=shazbot.org header.i=@shazbot.org header.b="yg+RF1cb"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="Z38yM0Tx" Received: from phl-compute-11.internal (phl-compute-11.internal [10.202.2.51]) by mailfout.phl.internal (Postfix) with ESMTP id EC493EC01A5; Wed, 26 Nov 2025 13:55:12 -0500 (EST) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-11.internal (MEProxy); Wed, 26 Nov 2025 13:55:12 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=shazbot.org; h= cc:cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm3; t=1764183312; x=1764269712; bh=37p6Cw1ME0a5Obcfe11/W4zuJ0UdrkK9wi8CHO9UaCk=; b= yg+RF1cb+tDquSnVORpKSHeayI14y8YIFZvCLIBFA2zR13jRjziwlQ7+Ehy8DcX4 f+5Ugd6JEPl3g1+nPMIwz/ci9HyMTiTh7BclOEO8meyP52q4fxO7llaSscEw3a4V lpbdHyVj75xlqdX9NtPYZOEmsovmVyXjFWG26E8TcQFlsvdtgvzJlvJkFFo013+m BHqWGZlpJihrh2kObiw+J5JO5TzoYQmDEk9bv/UCOKrMYD6l6S7LPXbAiLafZNTZ F/io2eojXUW97Em3mN56HNO/iBjfXHAwRq5qiKhMlLeboTYVms/Urt19qsw8O8He R4sgC6VGcJA5AWC55cMdhg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1764183312; x= 1764269712; bh=37p6Cw1ME0a5Obcfe11/W4zuJ0UdrkK9wi8CHO9UaCk=; b=Z 38yM0Tx7mcpziDex2GDBB9S5N07P4lUXsgG5xBqAvl59RHOpBnc7TnBPbkkIZStB 9B8C2OZItsvVEadioU5oCe8Tl8AZR9a3HuZCMnK47lomn7ad7f4L2pk1mEGJWfDo buyX0S9o7NXecKcTQtemu0PoSNb0c9uExLZzr9fcZRJrjnEceoQV3hqW6VwnKI78 7pUm3moWxCOxQZycrDd7C80WoUNGdpomT0kfvVMI905GHWvPA9/jg2RKeXpQmUPc kxLcMEPX0VnM77/3sRn4beXV93iqveNCzvUsbl/fmku7JFSaAQ0DXn1vgED1Xtmh yBJFI9GYAUE3CAOXeDe0w== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtdeggddvgeehuddvucetufdoteggodetrf dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfurfetoffkrfgpnffqhgenuceu rghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujf gurhepfffhvfevuffkjghfgggtgfesthejredttddtvdenucfhrhhomheptehlvgigucgh ihhllhhirghmshhonhcuoegrlhgvgiesshhhrgiisghothdrohhrgheqnecuggftrfgrth htvghrnhephedvtdeuveejudffjeefudfhueefjedvtefgffdtieeiudfhjeejhffhfeeu vedunecuffhomhgrihhnpehkvghrnhgvlhdrohhrghenucevlhhushhtvghrufhiiigvpe dtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegrlhgvgiesshhhrgiisghothdrohhrghdp nhgspghrtghpthhtohepudefpdhmohguvgepshhmthhpohhuthdprhgtphhtthhopehjgh hgseiiihgvphgvrdgtrgdprhgtphhtthhopegrmhgrshhtrhhosehfsgdrtghomhdprhgt phhtthhopehsuhhmihhtrdhsvghmfigrlheslhhinhgrrhhordhorhhgpdhrtghpthhtoh eptghhrhhishhtihgrnhdrkhhovghnihhgsegrmhgurdgtohhmpdhrtghpthhtoheplhgv ohhnsehkvghrnhgvlhdrohhrghdprhgtphhtthhopehkvghvihhnrdhtihgrnhesihhnth gvlhdrtghomhdprhgtphhtthhopehnihgtohhlihhntgesnhhvihguihgrrdgtohhmpdhr tghpthhtoheplhhinhhugidqmhgvughirgesvhhgvghrrdhkvghrnhgvlhdrohhrghdprh gtphhtthhopegurhhiqdguvghvvghlsehlihhsthhsrdhfrhgvvgguvghskhhtohhprdho rhhg X-ME-Proxy: Feedback-ID: i03f14258:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 26 Nov 2025 13:55:11 -0500 (EST) Date: Wed, 26 Nov 2025 11:55:09 -0700 From: Alex Williamson To: Jason Gunthorpe Cc: Alex Mastro , Sumit Semwal , Christian =?UTF-8?B?S8O2bmln?= , Leon Romanovsky , Kevin Tian , Nicolin Chen , linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Ankit Agrawal Subject: Re: [PATCH] dma-buf: fix integer overflow in fill_sg_entry() for buffers >= 8GiB Message-ID: <20251126115509.27d420b9.alex@shazbot.org> In-Reply-To: <20251126180107.GA542915@ziepe.ca> References: <20251125-dma-buf-overflow-v1-1-b70ea1e6c4ba@fb.com> <20251126180107.GA542915@ziepe.ca> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Wed, 26 Nov 2025 14:01:07 -0400 Jason Gunthorpe wrote: > On Tue, Nov 25, 2025 at 05:11:18PM -0800, Alex Mastro wrote: > > fill_sg_entry() splits large DMA buffers into multiple scatter-gather > > entries, each holding up to UINT_MAX bytes. When calculating the DMA > > address for entries beyond the second one, the expression (i * UINT_MAX) > > causes integer overflow due to 32-bit arithmetic. > > > > This manifests when the input arg length >= 8 GiB results in looping for > > i >= 2. > > > > Fix by casting i to dma_addr_t before multiplication. > > > > Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping routine") > > Signed-off-by: Alex Mastro > > --- > > More color about how I discovered this in [1] for the commit at [2]: > > > > [1] https://lore.kernel.org/all/aSZHO6otK0Heh+Qj@devgpu015.cco6.facebook.com > > [2] https://lore.kernel.org/all/20251120-dmabuf-vfio-v9-6-d7f71607f371@nvidia.com > > --- > > drivers/dma-buf/dma-buf-mapping.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > Reviewed-by: Jason Gunthorpe > > AlexW, can you pick this up? Yes, I'm planning to. Thanks, Alex