Commit 4dd6ce47 authored Nov 03, 2020 by Dan Carpenter Committed by Joerg Roedel Nov 03, 2020

iommu: Fix a check in iommu_check_bind_data()



The "data->flags" variable is a u64 so if one of the high 32 bits is
set the original code will allow it, but it should be rejected.  The
fix is to declare "mask" as a u64 instead of a u32.

Fixes: d9057381 ("iommu/uapi: Handle data and argsz filled by users")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20201103101623.GA1127762@mwanda


Signed-off-by: Joerg Roedel <jroedel@suse.de>

parent 71cd8e2d

drivers/iommu/iommu.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2071,7 +2071,7 @@ EXPORT_SYMBOL_GPL(iommu_uapi_cache_invalidate);

		static int iommu_check_bind_data(struct iommu_gpasid_bind_data *data)
		{
		u32 mask;
		u64 mask;
		int i;

		if (data->version != IOMMU_GPASID_BIND_VERSION_1)

Admin message