iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()

JIRA: https://issues.redhat.com/browse/RHEL-75942

commit e24c155
Author: Qasim Ijaz <qasdev00@gmail.com>
Date:   Mon Jan 13 22:38:20 2025 +0000

    iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()

    Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index()
    where shifting the constant "1" (of type int) by bitmap->mapped.pgshift
    (an unsigned long value) could result in undefined behavior.

    The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds
    31 (e.g., pgshift = 63) the shift operation overflows, as the result
    cannot be represented in a 32-bit type.

    To resolve this, the constant is updated to "1UL", promoting it to an
    unsigned long type to match the operand's type.

    Fixes: 58ccf01 ("vfio: Add an IOVA bitmap support")
    Link: https://patch.msgid.link/r/20250113223820.10713-1-qasdev00@gmail.com
    Reported-by: syzbot <syzbot+85992ace37d5b7b51635@syzkaller.appspotmail.com>
    Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
    Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
    Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

Signed-off-by: Eder Zulian <ezulian@redhat.com>

Author: efzrh

drivers/iommu/iommufd/iova_bitmap.c

@@ -130,7 +130,7 @@ struct iova_bitmap {
 static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap,
 						 unsigned long iova)
 {
-	unsigned long pgsize = 1 << bitmap->mapped.pgshift;
+	unsigned long pgsize = 1UL << bitmap->mapped.pgshift;
 
 	return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize);
 }