Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases. Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b1af23d836f811137d504d14d4cbdd01929dec34 to < 98d8dcc4ebd10523507d4478e148809a7771a213affectedb1af23d836f811137d504d14d4cbdd01929dec34 to < 9fd9c9bbb05417f468a11fb6d145d7ff61f4a868affectedb1af23d836f811137d504d14d4cbdd01929dec34 to < 3776bf56e06980e8a12c8c0565d9e6ac44965f03affectedb1af23d836f811137d504d14d4cbdd01929dec34 to < d6a1779129d936bc1fbab80181165da544eab736affectedb1af23d836f811137d504d14d4cbdd01929dec34 to < d48ceb6e1a6915c7bac4f902554a1047365cdff2affectedb1af23d836f811137d504d14d4cbdd01929dec34 to < 0543813753ef5cfbd6fa96694f7acf783fa01af7affectedb1af23d836f811137d504d14d4cbdd01929dec34 to < 314091243159f8e3749bc719bb129f423f72fd86affectedb1af23d836f811137d504d14d4cbdd01929dec34 to < 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71affected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/98d8dcc4ebd10523507d4478e148809a7771a213 ↗
- https://git.kernel.org/stable/c/9fd9c9bbb05417f468a11fb6d145d7ff61f4a868 ↗
- https://git.kernel.org/stable/c/3776bf56e06980e8a12c8c0565d9e6ac44965f03 ↗
- https://git.kernel.org/stable/c/d6a1779129d936bc1fbab80181165da544eab736 ↗
- https://git.kernel.org/stable/c/d48ceb6e1a6915c7bac4f902554a1047365cdff2 ↗
- https://git.kernel.org/stable/c/0543813753ef5cfbd6fa96694f7acf783fa01af7 ↗
- https://git.kernel.org/stable/c/314091243159f8e3749bc719bb129f423f72fd86 ↗
- https://git.kernel.org/stable/c/0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71 ↗