From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f44.google.com (mail-qv1-f44.google.com [209.85.219.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 55D87433E7B for ; Mon, 13 Jul 2026 13:51:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783950662; cv=none; b=bPKz5lj2soS/WSZhEPUiHs+zoC9AnDiktggl6io9hsCs+DW6y4E1kSOW+ZTBba9Fcp+KQGPAFPGlwq9XlaWSG3wQnV1dcCyXRLhIreqOFd2eYvdyVQaILwn72NwEld5Pv18T//2dr0FAZCHdAD4s/ZdTtPB7u6IR78j/anRUEvU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783950662; c=relaxed/simple; bh=3b65f9HscW/yV2xQrFsKLyYDme29l/rrNYv8VEkDzyM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=GoCGKxEjriZYzaPx6IMh60ICe/UPiKAXxDZ3e4A2JaxNL5uubNexyoJ++seRnAN8p8N5XwOjnwrWweqkVOTJAip2jxLO5P0u7bFkHC09GeRACyIYYG7DpEvix/xJKpe1uHSYcKCtuNo8uZNz58zGS1SqK6bMUlgQqSpKZEqUrz8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=bH3dv2we; arc=none smtp.client-ip=209.85.219.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="bH3dv2we" Received: by mail-qv1-f44.google.com with SMTP id 6a1803df08f44-8efef6533aaso25608766d6.0 for ; Mon, 13 Jul 2026 06:51:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1783950660; x=1784555460; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=j7BFsAeY/cNxYBhDdt5lEE2McwL0FHxSEO7wsqO2A6c=; b=bH3dv2wekE9U8QvB2Nt8auLomLo/Q28CDkQCK0I2Pj+NaGq7KWbpalqn2+k33kMOaI XuoQNuAsZ7PWrBwZNrI336+xu+EqLjD6VoKmwabQooNnZ4ZEUiC7Tel1Q8NcEK0EoQgJ CvTmOx7VJHgSPCfQM1IDnK9MBGegPa4Cc3biisxI9P1NQcd/ZY9wSNHYyTbXnmd53Eun BRwnhSvXPBRz/TRI417zSKWQkUF+UR3ksfmqGHiNrAywxmmTj784Xg5D/GYqNgk5ZT+p Dh08Y/2IKarIUcTFuzBBNcNp9d5ww2qTnIq/37w2338j4SGoEQNRBO4v5RpqVnSNZNU+ tpCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783950660; x=1784555460; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=j7BFsAeY/cNxYBhDdt5lEE2McwL0FHxSEO7wsqO2A6c=; b=krKCJGoQkFuGdOKXHVkxkHCzVdYUNRsAOfxCuFcJ0IW7MdRDInkZylwfKGC3uhka4a UKeKk8aRMIUEPjQx1oYi8JkYUGuBMp5l1/yQ6ttKmjBQ6ynKZ3FwOUpxM2YjettaPO+Z tu6rxmoDFUiRi/RtDN0ljgkLhU7tuPXHhWi6tCbmbYKzfOUhtCkWUcNojqD0BaxHHWsr BXMPWR0lXq+bA72HWwqWXNwiCnXJaH7FmLgz6YlkOibIZrODB/y6W6aoGMW7LGonC4qg SNPNPFDcKKJBtAN4TNmDzUwJHLd5eHKF7IEXdvCUD4IVMD1u++Si/zntp2l01pGmPhEi iJug== X-Forwarded-Encrypted: i=1; AHgh+RrWA9eKNtb3tMzb/ybPwQ09uf4dcM0jqCE15xYMN2YxaLOe8s7UsmXUoiKCn3HCACTpxMPaRsNK+L5hAS0=@vger.kernel.org X-Gm-Message-State: AOJu0YygcxDqemGDIQXyBA2lwVMiGHUpadEHVHhtQTRiVR8BBrIbV4yh quLXeS/V14mIjG1wbWCv7qirBUKgcjoyHPv24czr8keKod33uvPVQNI3VwaG8EgmxiE= X-Gm-Gg: AfdE7cmg12JPfCuzna3KoFbUyzfjssOQh4xwFjrD5aZOMbGUmS8Ld+Pifq11Psz2K9L wduN+ghxnOXNMf920KQyOM7XofB8Ix7WdL/7Ju659HNpxP26rqFoPErUgOrD4ynGZq+bt12acih JePplWD/ZYjVvpUYiAQvdfGxBZYpv5d1PGDk7DS5dyoIp/zA43DZ4YHZgfL4fUE0/FqIKGBwETp MxWG6aYTR9KNFwmGgFmTVp+hggIPyqb70jkMTtFedgEhoev9Rk77mlK6Lj2rC+KPpmJL8Vc6TUa 6xLJM0QovrwQMPDAuQCbKsfBx1fgRP8nnPRkYDOWhEH/GNfjqwDa8YaV/NzV6eWgpUDqI3XW3oR 1fEDvFnAp4YXF6wRhlGAavRpVd2MD/A4D0LtbLpOTWgkOuk5hE8/GUSzvCq0I X-Received: by 2002:a05:620a:45ab:b0:915:6453:1ae with SMTP id af79cd13be357-92ef2b35176mr930845485a.14.1783950660057; Mon, 13 Jul 2026 06:51:00 -0700 (PDT) Received: from ziepe.ca ([159.2.72.92]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5d61fb9sm1040677385a.41.2026.07.13.06.50.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 06:50:59 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wjH3i-0000000DKBL-2vAC; Mon, 13 Jul 2026 10:50:58 -0300 Date: Mon, 13 Jul 2026 10:50:58 -0300 From: Jason Gunthorpe To: Samuel Moelius Cc: Kevin Tian , "Joerg Roedel (AMD)" , Will Deacon , Robin Murphy , "open list:IOMMUFD" , open list Subject: Re: [PATCH v3] iommu/iommufd: avoid selftest dirty bitmap size wrap Message-ID: <20260713135058.GA3133966@ziepe.ca> References: <20260628152331.82122.408afd7b466c.iommufd-test-dirty-bitmap-size-wrap@trailofbits.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260628152331.82122.408afd7b466c.iommufd-test-dirty-bitmap-size-wrap@trailofbits.com> On Sun, Jun 28, 2026 at 03:23:32PM +0000, Samuel Moelius wrote: > IOMMU_TEST_OP_DIRTY sizes its temporary dirty bitmap from > length / page_size. Very large selftest ranges can make the > DIV_ROUND_UP() additions wrap before allocation, producing a > zero-length allocation while the later test_bit() loop still walks the > original number of bits. > > The selftest helper does not need to support unbounded dirty bitmap > sizes. Reject requests whose range cap calculation overflows, or whose > range exceeds SZ_16M pages, before converting the value to bitmap > allocation and copy sizes. I suggested to limit either the length or the kvzalloc to around 16M as a practical limit > @@ -1686,6 +1687,8 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id, > u32 flags) > { > unsigned long i, max; > + unsigned long max_pages = SZ_16M; > + unsigned long max_length; > struct iommu_test_cmd *cmd = ucmd->cmd; > struct iommufd_hw_pagetable *hwpt; > struct mock_iommu_domain *mock; > @@ -1705,6 +1708,15 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id, > goto out_put; > } > > + if (check_mul_overflow(max_pages, page_size, &max_length)) { > + rc = -EOVERFLOW; > + goto out_put; > + } > + if (length > max_length) { > + rc = -EOVERFLOW; > + goto out_put; > + } This is some huge number, so big that this breaks the logic on 32 bits. It just needs this: + max = length / page_size; + if (max > SZ_16M * BITS_PER_BYTE) + return -EOVERFLOW; At the top where it validates the arguments. I revised this patch and merged it. Jason