From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f51.google.com (mail-qv1-f51.google.com [209.85.219.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F040A3EB0E2 for ; Tue, 9 Jun 2026 17:52:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781027555; cv=none; b=clcbqfznjP8RDw3Em+sGaxMl0NmIAL95LRxJewKmsRwVWo+XFoi3ubK2IIpRWO48C7Rpa8Yi6zArPyVlx2/6M0P+tSKUmmM77m6AXy1/FDzclhu1X8J2kxjStAqomE996Tjaax+Px2YK6VS3++sMW3UNEfG2BpFqkFFCcFsVUGE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781027555; c=relaxed/simple; bh=Ac013OJzAwVej+OVP2LZCtn5OfbQt2Qvy1YCJyc+Jxo=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ZjFtca7nBQdmL9avzBmUq7W5XgXAvuc6RU/RwL98UFCn/V1/rBuol2PRQQnhmQjOmMvHo0wqy8fDEdKmmSDa1jz4dqFsrvLdurIGiDERr8eP1rsG2H8leTQOBSWEPmCw7o0ZzvEcoVvuuR5hFUk2UF2lrQaqEdDIUYz/0ofoloQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=dkLnFnTt; arc=none smtp.client-ip=209.85.219.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="dkLnFnTt" Received: by mail-qv1-f51.google.com with SMTP id 6a1803df08f44-8ced8f44da0so65420366d6.2 for ; Tue, 09 Jun 2026 10:52:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1781027553; x=1781632353; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=Rz1mWQA0X5bITct5GpKOKK787oK9AjLeNSvrgnb5Vlk=; b=dkLnFnTtwbTM+x7VuC6+pzmbdEn/8AJZ1NgWI62H313/XcAIjzIs90ZCUXq1ftp3fe d+C1XXX6WEu7Nqnyd41sQfyGjNWBke7GIZmpyAwfy+n98iBhhsLkK9sfQKXato2A9jBV xnewMWjAJNZlZRzCpN3kMGhPUvmwtARBwfQ5kL640WW0JPud/bVMd2GY1XhjhyliaXlC c+ThoGLIMw65xFIwFYtKlimPTN5te5vEA0mN3yNLq2/PlSuKdVP4eRH+k3S2hczN9gFt xvMZi/ByGwjkj/azh968DdyklNUaba+gouEPbGlnxFAPPszDwAtTv1I6TA/eHJxGRFCC d2/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781027553; x=1781632353; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Rz1mWQA0X5bITct5GpKOKK787oK9AjLeNSvrgnb5Vlk=; b=Te7yA64IrsTNVLXKtkFEkyzrV95hO64fuMBuAn+tdq7sDa99XzvbJNjigw8CwQcugm XPMtHkb+DLr5JlEhRTJ5lQfbSGNg5GecPt/jORK6rKKsiwHaI7Yh47WjPGP+Z0Y7uqkb 2NUnfbwGQLh02FEVAl4Zu92YrNtT34DdbWYqz8iL1K5u/DkYMqYTgqt4zFa1jWvAyDJf 7Z1kd7H2PZjKib6QDcIm6xxZ4HGRGZ21+cYSCWUYXrQlClquXN2XEk0yIxMhWYWwLDUP 3leWszIwke56mpnPMw4U1kRhA3OrJGExveNbmFFDlAmzblD3XtY+14WRwhNB81KKBWSR 4kQA== X-Forwarded-Encrypted: i=1; AFNElJ8v0nTNPFG4dDAfNKbrY30bl6ZGQUQKlPnOvMq9cPc7WWFoj0lAyuqS1fBtopxWhsu+F9Dz1+16wRsZe2s=@vger.kernel.org X-Gm-Message-State: AOJu0YzA+dMSpp6QlXxtj5SiySHCNkv/q7MOI2iCiQyXTnsiQDXmaifY cXe5gKWSH7JCbkGwbk9vRxkk/Qu8MVhsI5JjVBM7IvmVaiDkyvzMujaDQ4mMBiCQU8s= X-Gm-Gg: Acq92OG8Bd9pOKnFNTtEd0wOmlu+jd58ze434IxlVTmTJY6Qew5H+UBPlsYOh5RDuk/ q446u83+bmcPLgQrmwLIabcJTo0SFzl5RK3A4IAHGmTXkL8mObtg8VQ6rwkYMQ2il2YkLiXL1o6 lapQQTVGw0bEJURfus0Irn6se2Bs+JEy2JGZbeXbjtGXNPrlq7Urt//5MF8am9EU8MQXstNF/s8 kTShMNZOHWuUgEctMnxw+LPME51Uarz0oWEYSdMB27T3Ie1kns73i7AqwJRk3QG9SYfQ1lKDx49 mvrRmu+FsLIkh3mrEpvJJgO81M5zvNPw45/T2s5efle6CO/BaZq7Ilyhiikj21uGViGWzxMkt/B bh7cTM6hBUU+3rV6Y2mhCZ1N8wVf64/cPj7/xisQLiyNswG+isFeF7BaWO4yPj4RBN4rYJ0pm4k B6yAFMWG2JEPeJmqgkM8zjgczLOLmpn7f/U8i3rxfoCEchuzMy+uZvame2Z+sZ8GzhgSzT2lQ6I LDJkLHS/VfyfkE1hFxVRYbLM2M= X-Received: by 2002:a05:622a:58cf:b0:517:5b79:c109 with SMTP id d75a77b69052e-51795ba35f0mr289094861cf.56.1781027552939; Tue, 09 Jun 2026 10:52:32 -0700 (PDT) Received: from ziepe.ca (crbknf0213w-47-54-130-67.pppoe-dynamic.high-speed.nl.bellaliant.net. [47.54.130.67]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8cecd053032sm216490686d6.24.2026.06.09.10.52.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jun 2026 10:52:32 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wX0cp-00000002Lrp-3o9X; Tue, 09 Jun 2026 14:52:31 -0300 Date: Tue, 9 Jun 2026 14:52:31 -0300 From: Jason Gunthorpe To: Samuel Moelius Cc: Kevin Tian , "Joerg Roedel (AMD)" , Will Deacon , Robin Murphy , "open list:IOMMUFD" , open list Subject: Re: [PATCH] iommu/iommufd: avoid selftest dirty bitmap size wrap Message-ID: <20260609175231.GN2764304@ziepe.ca> References: <20260609005517.1241471.82360db24575.iommufd-test-dirty-bitmap-size-wrap@trailofbits.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260609005517.1241471.82360db24575.iommufd-test-dirty-bitmap-size-wrap@trailofbits.com> On Tue, Jun 09, 2026 at 12:55:18AM +0000, Samuel Moelius wrote: > IOMMU_TEST_OP_DIRTY sizes its temporary dirty bitmap from > length / page_size. Very large selftest ranges can make the > DIV_ROUND_UP() additions wrap before allocation, producing a > zero-length allocation while the later test_bit() loop still walks the > original number of bits. > > Reject bitmap sizes whose byte or unsigned-long counts cannot be > computed without overflow, and use array_size() for the allocation. > > Assisted-by: Codex:gpt-5.5-cyber-preview > Signed-off-by: Samuel Moelius > --- > drivers/iommu/iommufd/selftest.c | 15 ++++++++++++--- > 1 file changed, 12 insertions(+), 3 deletions(-) > > diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c > index af07c642a526..08c36d9ba3e4 100644 > --- a/drivers/iommu/iommufd/selftest.c > +++ b/drivers/iommu/iommufd/selftest.c > @@ -1685,8 +1685,9 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id, > unsigned long page_size, void __user *uptr, > u32 flags) > { > - unsigned long i, max; > struct iommu_test_cmd *cmd = ucmd->cmd; > + unsigned long i, max, nr_bytes; > + unsigned long nr_longs; > struct iommufd_hw_pagetable *hwpt; > struct mock_iommu_domain *mock; > int rc, count = 0; > @@ -1706,14 +1707,22 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id, > } > > max = length / page_size; > - tmp = kvzalloc(DIV_ROUND_UP(max, BITS_PER_LONG) * sizeof(unsigned long), > + if (check_add_overflow(max, BITS_PER_LONG - 1, &nr_longs) || > + check_add_overflow(max, BITS_PER_BYTE - 1, &nr_bytes)) { We can just limit length to something, it isn't like this: > + tmp = kvzalloc(array_size(nr_longs, sizeof(unsigned long)), > GFP_KERNEL_ACCOUNT); > if (!tmp) { Will work with big numbers anyhow. I suggest length > SZ_16M * page_size with a check mul overflow Jason