]> git.ipfire.org Git - thirdparty/linux.git/commit
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
authorSebastian Alba Vives <sebasjosue84@gmail.com>
Mon, 18 May 2026 19:07:41 +0000 (13:07 -0600)
committerXu Yilun <yilun.xu@linux.intel.com>
Mon, 1 Jun 2026 04:29:13 +0000 (12:29 +0800)
commitfc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27
treee5f94fa612b8179e38186ce6f319d7ca33e6efc3
parent9e8bc49f91f3f81d957c4f1c1f09fe94e2f88f6a
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

afu_ioctl_dma_map() accepts a 64-bit length from userspace via
DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value
is passed to afu_dma_pin_pages() where npages is derived as
length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes
int nr_pages, causing implicit truncation if length is very large.

Validate map.length at the ioctl entry point before calling
afu_dma_map_region(), rejecting values whose page count exceeds
INT_MAX.

Fixes: fa8dda1edef9 ("fpga: dfl: afu: add DFL_FPGA_PORT_DMA_MAP/UNMAP ioctls support")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260518190742.61426-3-sebasjosue84@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
drivers/fpga/dfl-afu-main.c