In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs

In iommummiowrite() and iommucapabilitywrite(), the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser(). If a user provides a sufficiently large value, it can become a negative integer.

Prior to this patch, the AMD IOMMU debugfs implementation was already protected by different mechanisms.

1. define OFSINSZ 8 ensures the user string <= 8 bytes, so

   e.g. 0xffffffff isn't a valid input.

   if (cnt > OFSINSZ) return -EINVAL;

2. Implicit type promotion in iommummiowrite(), dbgmmiooffset is int and iommu->mmiophysend is u64

   if (dbgmmiooffset > iommu->mmiophysend - sizeof(u64)) return -EINVAL;

3. The show handlers would currently catch the negative number and refuse to perform the read.

Replace kstrtou32fromuser() with kstrtos32fromuser() to parse the input, and check for negative values to explicitly prevent out-of-bounds memory accesses directly in iommummiowrite() and iommucapabilitywrite().