On 08/10/2025 19:17, Jason Gunthorpe wrote:

If pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow to 0 and this triggers divide by 0.

In this case the index should just be 0, so reorganize things to divide by shift and avoid hitting any overflows.

Cc: stable@vger.kernel.org Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") Reported-by: syzbot+093a8a8b859472e6c257@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=093a8a8b859472e6c257 Signed-off-by: Jason Gunthorpe jgg@nvidia.com

Reviewed-by: Joao Martins joao.m.martins@oracle.com

---

drivers/iommu/iommufd/iova_bitmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c index 4514575818fc07..b5b67a9d3fb35e 100644 --- a/drivers/iommu/iommufd/iova_bitmap.c +++ b/drivers/iommu/iommufd/iova_bitmap.c @@ -130,9 +130,8 @@ struct iova_bitmap { static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap, unsigned long iova) {

• unsigned long pgsize = 1UL << bitmap->mapped.pgshift;
• return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize);

• return (iova >> bitmap->mapped.pgshift) /

•       BITS_PER_TYPE(*bitmap->bitmap);
  

} /*

base-commit: 2a918911ed3d0841923525ed0fe707762ee78844