Messages in this thread |  | | Date | Sat, 4 Apr 2026 09:01:25 +0200 | | From | Greg KH <> | | Subject | Re: [PATCH v2] fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() |
| |
On Fri, Apr 03, 2026 at 11:57:18AM -0600, Sebastian Alba Vives wrote: > From: Sebastian Josue Alba Vives <sebasjosue84@gmail.com> > > region->length comes from userspace via the DFL_FPGA_PORT_DMA_MAP ioctl > as a __u64 value. While the function checks for page alignment and > address overflow, there is no upper bound on the length value. When > length >> PAGE_SHIFT exceeds INT_MAX, the downstream call to > pin_user_pages_fast() (which takes int nr_pages) receives a truncated > value. > > Add the length validation alongside the existing input checks in > afu_dma_map_region(), where all userspace arguments are validated > before being passed deeper into the call chain. > > Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com> > --- > Changes in v2: > - Move validation from afu_dma_pin_pages() to afu_dma_map_region() > to validate at the ioctl entry point as suggested by Greg KH
This isn't the ioctl entry point, why not put it in afu_ioctl_dma_map() with the other checks?
thanks,
greg k-h
|  |