The check for the dart table index allowed values of
(1 << data->tbl_bits) while only as many entries are initialized in
apple_dart_alloc_pgtable. This results in an array out of bounds access
when data->tbl_bits is at its maximal value of 2. When data->tbl_bits is
0 or 1 an unset (initialized to zero) data->pgd[] entry is used. In both
cases the value is used as pointer to read page table entries and
results in dereferencing invalid pointers.
There is no prior check that the passed iova is inside the iommu's IAS
so invalid values can be passed from driver's calling iommu_map().

Fixes: 74a0e72f03ff ("iommu/io-pgtable-dart: Add 4-level page table support")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/asahi/aMACFlJjrZHs_Yf-@stanley.mountain/
Signed-off-by: Janne Grunau <j@jannau.net>
---
Based on today's iommu/master (9bffaa5ceb26) [1]

[1] https://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux.git
---
 drivers/iommu/io-pgtable-dart.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/io-pgtable-dart.c b/drivers/iommu/io-pgtable-dart.c
index 9a63c80a2786bf70fc2544b1f96d2e4c8591c2f8..54d287cc0dd1b8bb07eb437a23ae0e493645a80d 100644
--- a/drivers/iommu/io-pgtable-dart.c
+++ b/drivers/iommu/io-pgtable-dart.c
@@ -177,7 +177,7 @@ static dart_iopte *dart_get_last(struct dart_io_pgtable *data, unsigned long iov
 	int level = data->levels;
 	int tbl = dart_get_index(data, iova, level);
 
-	if (tbl > (1 << data->tbl_bits))
+	if (tbl >= (1 << data->tbl_bits))
 		return NULL;
 
 	ptep = data->pgd[tbl];
@@ -246,7 +246,7 @@ static int dart_map_pages(struct io_pgtable_ops *ops, unsigned long iova,
 
 	tbl = dart_get_index(data, iova, level);
 
-	if (tbl > (1 << data->tbl_bits))
+	if (tbl >= (1 << data->tbl_bits))
 		return -ENOMEM;
 
 	ptep = data->pgd[tbl];

---
base-commit: 9bffaa5ceb26d73344b1a16b745f363fb2a6f6b4
change-id: 20250909-iommu-dart-tbl-check-fix-23d5add6bbf9

Best regards,
-- 
Janne Grunau <j@jannau.net>

On Tue, Sep 09, 2025 at 01:54:43PM +0200, Janne Grunau wrote:
>  drivers/iommu/io-pgtable-dart.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Applied, thanks.