Commit 0b271f7d7f5e for kernel

commit 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71
Author: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Date:   Tue Sep 15 22:04:17 2026 +0530

    powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

    The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified
    IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba().
    While doing so, the passed in argument npages is ignored and constant
    value '1' is used leaving out a possible overflow as the callers can
    legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT
    cases.

    Fix this by accounting for 'npages', checking for arithmetic overflow,
    and verifying that the entire requested range (ioba - offset + npages)
    does not exceed the table capacity 'size'.

    Fixes: b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking")
    Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
    Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
    Signed-off-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
    Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>

diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index ee1b5cb557c9..1ae8384637b5 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -1076,7 +1076,7 @@ int iommu_tce_check_ioba(unsigned long page_shift,
 	if (ioba < offset)
 		return -EINVAL;

-	if ((ioba + 1) > (offset + size))
+	if ((ioba + npages < ioba) || (ioba - offset + npages > size))
 		return -EINVAL;

 	return 0;