All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jason Gunthorpe <jgg@nvidia.com>
To: Joao Martins <joao.m.martins@oracle.com>
Cc: iommu@lists.linux.dev, Kevin Tian <kevin.tian@intel.com>,
	Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org>,
	Robin Murphy <robin.murphy@arm.com>,
	syzbot+25dc7383c30ecdc83c38@syzkaller.appspotmail.com
Subject: Re: [PATCH] iommufd/selftest: Fix page-size check in iommufd_test_dirty()
Date: Mon, 30 Oct 2023 13:02:17 -0300	[thread overview]
Message-ID: <20231030160217.GU3952@nvidia.com> (raw)
In-Reply-To: <20231030113446.7056-1-joao.m.martins@oracle.com>

On Mon, Oct 30, 2023 at 11:34:46AM +0000, Joao Martins wrote:
> iommufd_test_dirty()/IOMMU_TEST_OP_DIRTY sets the dirty bits in the mock
> domain implementation that the userspace side validates against what it
> obtains via the UAPI.
> 
> However in introducing iommufd_test_dirty() it forgot to validate page_size
> being 0 leading to two possible divide-by-zero problems: one at the
> beginning when calculating @max and while calculating the IOVA in the
> XArray PFN tracking list.
> 
> While at it, validate the length to require non-zero value as well, as we
> can't be allocating a 0-sized bitmap.
> 
> Reported-by: syzbot+25dc7383c30ecdc83c38@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/linux-iommu/00000000000005f6aa0608b9220f@google.com/
> Fixes: a9af47e382a4 ("iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP")
> Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
> ---
> This applies against iommufd for-next, but on the other hand it could also be
> squashed in the commit in the Fixes: tag. Both should apply cleanly.
> ---
>  drivers/iommu/iommufd/selftest.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

Applied, thanks

Jason

      reply	other threads:[~2023-10-30 16:02 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-10-30 11:34 [PATCH] iommufd/selftest: Fix page-size check in iommufd_test_dirty() Joao Martins
2023-10-30 16:02 ` Jason Gunthorpe [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20231030160217.GU3952@nvidia.com \
    --to=jgg@nvidia.com \
    --cc=iommu@lists.linux.dev \
    --cc=joao.m.martins@oracle.com \
    --cc=joro@8bytes.org \
    --cc=kevin.tian@intel.com \
    --cc=robin.murphy@arm.com \
    --cc=syzbot+25dc7383c30ecdc83c38@syzkaller.appspotmail.com \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.