From 02b503ee16cc7e8a08d5103e92fd2ea6a0060263 Mon Sep 17 00:00:00 2001 From: Dylan Reid Date: Fri, 24 Apr 2026 16:57:24 -0700 Subject: [PATCH] virtio-devices: vdpa: checked arithmetic in dma_unmap dma_unmap computed `iova + size - 1` unchecked while the sibling dma_map already used checked_add/checked_sub. A guest reaching dma_unmap via VIRTIO_IOMMU_T_UNMAP could cause a panic. Signed-off-by: Dylan Reid --- virtio-devices/src/vdpa.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/virtio-devices/src/vdpa.rs b/virtio-devices/src/vdpa.rs index 44b5cfde8..92793d96a 100644 --- a/virtio-devices/src/vdpa.rs +++ b/virtio-devices/src/vdpa.rs @@ -365,7 +365,12 @@ impl Vdpa { } fn dma_unmap(&self, iova: u64, size: u64) -> Result<()> { - let iova_last = iova + size - 1; + let Some(iova_last) = iova.checked_add(size) else { + return Err(Error::InvalidIovaRange(iova, u64::MAX)); + }; + let Some(iova_last) = iova_last.checked_sub(1) else { + return Err(Error::InvalidIovaRange(0, 0)); + }; if iova < self.iova_range.first || iova_last > self.iova_range.last { return Err(Error::InvalidIovaRange(iova, iova_last)); }