From 3eff75f14ff67c968fa98c407cb55532722b6655 Mon Sep 17 00:00:00 2001 From: Mostafa Saleh Date: Fri, 5 Sep 2025 13:09:04 +0000 Subject: [PATCH] ANDROID: iommu/arm-smmu-v3-kvm: Fix SID validation At allocation time for L2 pointers SID should be checked. Also, there is a missing equal for the SID checks. Bug: 443053939 Change-Id: I63aaf0438640c0cb173f12405b9c67b3a9656c61 Signed-off-by: Mostafa Saleh (cherry picked from commit 0668e45a43398a07c3aa2ae08903097657efd87e) Signed-off-by: Lee Jones --- drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c index ed293c7bc927..ae79d713f67e 100644 --- a/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c @@ -307,8 +307,12 @@ static int smmu_alloc_l2_strtab(struct hyp_arm_smmu_v3_device *smmu, u32 sid) struct arm_smmu_strtab_l2 *l2table; size_t l2_order = get_order(sizeof(struct arm_smmu_strtab_l2)); int flags = 0; + u32 l1_idx = arm_smmu_strtab_l1_idx(sid); - l1_desc = &cfg->l2.l1tab[arm_smmu_strtab_l1_idx(sid)]; + if (l1_idx >= cfg->l2.num_l1_ents) + return -EINVAL; + + l1_desc = &cfg->l2.l1tab[l1_idx]; if (l1_desc->l2ptr) return 0; @@ -343,7 +347,7 @@ smmu_get_ste_ptr(struct hyp_arm_smmu_v3_device *smmu, u32 sid) &cfg->l2.l1tab[arm_smmu_strtab_l1_idx(sid)]; struct arm_smmu_strtab_l2 *l2ptr; - if (arm_smmu_strtab_l1_idx(sid) > cfg->l2.num_l1_ents) + if (arm_smmu_strtab_l1_idx(sid) >= cfg->l2.num_l1_ents) return NULL; /* L2 should be allocated before calling this. */ if (WARN_ON(!l1_desc->l2ptr)) @@ -354,7 +358,7 @@ smmu_get_ste_ptr(struct hyp_arm_smmu_v3_device *smmu, u32 sid) return &l2ptr->stes[arm_smmu_strtab_l2_idx(sid)]; } - if (sid > cfg->linear.num_ents) + if (sid >= cfg->linear.num_ents) return NULL; /* Simple linear lookup */ return &cfg->linear.table[sid];