iommu/msm: limit the per-master Machine ID list

[PATCH] iommu/msm: limit the per-master Machine ID list

Posted by Pengpeng Hou 2 days, 18 hours ago

The OF translation path appends each unique stream ID from an IOMMU
specifier to the fixed mids array in the per-master object. It currently
has no capacity check before storing at mids[num_mids] and incrementing
num_mids.

Return -ENOSPC when the array is full rather than writing the next ID
beyond it.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/iommu/msm_iommu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c
index 0ad5ff431d5b..0cc7a87037ce 100644
--- a/drivers/iommu/msm_iommu.c
+++ b/drivers/iommu/msm_iommu.c
@@ -622,6 +622,9 @@ static int insert_iommu_master(struct device *dev,
 			return 0;
 		}
 
+	if (master->num_mids >= MAX_NUM_MIDS)
+		return -ENOSPC;
+
 	master->mids[master->num_mids++] = spec->args[0];
 	return 0;
 }
-- 
2.43.0

Re: [PATCH] iommu/msm: limit the per-master Machine ID list

Posted by Will Deacon 2 days, 1 hour ago

On Wed, 22 Jul 2026 12:16:19 +0800, Pengpeng Hou wrote:
> The OF translation path appends each unique stream ID from an IOMMU
> specifier to the fixed mids array in the per-master object. It currently
> has no capacity check before storing at mids[num_mids] and incrementing
> num_mids.
> 
> Return -ENOSPC when the array is full rather than writing the next ID
> beyond it.
> 
> [...]

Applied to iommu (qualcomm/msm), thanks!

[1/1] iommu/msm: limit the per-master Machine ID list
      https://git.kernel.org/iommu/c/e283e646ee89

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev

Re: [PATCH] iommu/msm: limit the per-master Machine ID list

Posted by Dmitry Baryshkov 2 days, 16 hours ago

On Wed, Jul 22, 2026 at 12:16:19PM +0800, Pengpeng Hou wrote:
> The OF translation path appends each unique stream ID from an IOMMU
> specifier to the fixed mids array in the per-master object. It currently
> has no capacity check before storing at mids[num_mids] and incrementing
> num_mids.
> 
> Return -ENOSPC when the array is full rather than writing the next ID
> beyond it.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/iommu/msm_iommu.c | 3 +++
>  1 file changed, 3 insertions(+)
> 

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>


-- 
With best wishes
Dmitry