From a2d2e6ea1865d316e4f0c0bbd8275ffdc4ec62f5 Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Tue, 9 Sep 2025 13:54:43 +0200 Subject: [PATCH] iommu/io-pgtable-dart: Fix off by one error in table index check The check for the dart table index allowed values of (1 << data->tbl_bits) while only as many entries are initialized in apple_dart_alloc_pgtable. This results in an array out of bounds access when data->tbl_bits is at its maximal value of 2. When data->tbl_bits is 0 or 1 an unset (initialized to zero) data->pgd[] entry is used. In both cases the value is used as pointer to read page table entries and results in dereferencing invalid pointers. There is no prior check that the passed iova is inside the iommu's IAS so invalid values can be passed from driver's calling iommu_map(). Fixes: 74a0e72f03ff ("iommu/io-pgtable-dart: Add 4-level page table support") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/asahi/aMACFlJjrZHs_Yf-@stanley.mountain/ Signed-off-by: Janne Grunau Signed-off-by: Joerg Roedel --- drivers/iommu/io-pgtable-dart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/io-pgtable-dart.c b/drivers/iommu/io-pgtable-dart.c index 9a63c80a2786b..54d287cc0dd1b 100644 --- a/drivers/iommu/io-pgtable-dart.c +++ b/drivers/iommu/io-pgtable-dart.c @@ -177,7 +177,7 @@ static dart_iopte *dart_get_last(struct dart_io_pgtable *data, unsigned long iov int level = data->levels; int tbl = dart_get_index(data, iova, level); - if (tbl > (1 << data->tbl_bits)) + if (tbl >= (1 << data->tbl_bits)) return NULL; ptep = data->pgd[tbl]; @@ -246,7 +246,7 @@ static int dart_map_pages(struct io_pgtable_ops *ops, unsigned long iova, tbl = dart_get_index(data, iova, level); - if (tbl > (1 << data->tbl_bits)) + if (tbl >= (1 << data->tbl_bits)) return -ENOMEM; ptep = data->pgd[tbl]; -- 2.47.3