diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-11-03 13:16:23 +0300 |
|---|---|---|
| committer | Joerg Roedel <jroedel@suse.de> | 2020-11-03 14:55:51 +0100 |
| commit | 4dd6ce478003525df8618750d30f0b90380047a7 (patch) | |
| tree | f436e88e80c3a0ff7a07d6abb4a98f5b96ef41bd | |
| parent | 71cd8e2d16703a9df5c86a9e19f4cba99316cc53 (diff) | |
| download | linux-4dd6ce478003525df8618750d30f0b90380047a7.tar.bz2 | |
iommu: Fix a check in iommu_check_bind_data()
The "data->flags" variable is a u64 so if one of the high 32 bits is
set the original code will allow it, but it should be rejected. The
fix is to declare "mask" as a u64 instead of a u32.
Fixes: d90573812eea ("iommu/uapi: Handle data and argsz filled by users")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20201103101623.GA1127762@mwanda
Signed-off-by: Joerg Roedel <jroedel@suse.de>
| -rw-r--r-- | drivers/iommu/iommu.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index 8c470f451a32..b53446bb8c6b 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -2071,7 +2071,7 @@ EXPORT_SYMBOL_GPL(iommu_uapi_cache_invalidate); static int iommu_check_bind_data(struct iommu_gpasid_bind_data *data) { - u32 mask; + u64 mask; int i; if (data->version != IOMMU_GPASID_BIND_VERSION_1) |