Re: [RFC PATCH 4/6] selftests/vfio: Exercise sPAPR DDW path for hugepage DMA mappings

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The selftest helper `spapr_tce_iova_inside_window` fails to check for arithmetic overflow when validating whether an IOVA range fits within the window.
--

commit 09ce4770fae5d9e1ed108bb9feb0bc727a9b8bcc
Author: Narayana Murty N <nnmlinux@linux.ibm.com>

selftests/vfio: Exercise sPAPR DDW path for hugepage DMA mappings

Prepare the DMA window before IOVA allocation in the DMA mapping tests.
Anonymous mappings use the default sPAPR DMA window, while HugeTLB mappings
force a DDW with the requested page size. The tests are skipped gracefully
if allocation fails or if the platform lacks support.

> diff --git a/tools/testing/selftests/vfio/vfio_dma_mapping_test.c b/tools/testing/selftests/vfio/vfio_dma_mapping_test.c
> index 7d0de8c79de13..4411fdbd56da5 100644
> --- a/tools/testing/selftests/vfio/vfio_dma_mapping_test.c
> +++ b/tools/testing/selftests/vfio/vfio_dma_mapping_test.c
[ ... ]
> @@ -236,6 +249,13 @@ FIXTURE_SETUP(vfio_dma_map_limit_test)
>  
>  	self->iommu = iommu_init(variant->iommu_mode);
>  	self->device = vfio_pci_device_init(device_bdf, self->iommu);
> +
> +	ret = iommu_prepare_dma_window(self->iommu, region_size, region_size,
> +				       false);

[Severity: Medium]
Will this setup cause the test suite to silently pass invalid mappings in the
overflow test?

In tools/testing/selftests/vfio/lib/iommu.c, spapr_tce_iova_inside_window()
checks bounds using:

    if (region->iova + region->size > window->start + window->size)
        return false;

When the vfio_dma_map_limit_test's overflow test constructs a wrapping IOVA
(region->iova = ~(iova_t)0 & ~(region->size - 1)), region->iova + region->size
will wrap around to 0.

Since 0 is not greater than window->start + window->size, the check incorrectly
evaluates to false, making the function return true.  Does this missing overflow
check defeat the wrapper's bounds validation and pass invalid mapping requests
down to the kernel ioctl?

> +	if (ret)
> +		SKIP(return, "DMA window unavailable: %s (%d)\n",
> +		     strerror(-ret), -ret);
> +
>  	region->vaddr = mmap(NULL, self->mmap_size, PROT_READ | PROT_WRITE,
>  			     MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
>  	ASSERT_NE(region->vaddr, MAP_FAILED);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703032806.40946-1-nnmlinux@linux.ibm.com?part=4