Re: [PATCH] iommufd/selftest: Fix buffer read overrrun in the dirty test

[Jason Gunthorpe <jgg@nvidia.com>]

On Thu, Aug 22, 2024 at 05:52:26PM +0100, Joao Martins wrote:
> On 22/08/2024 15:47, Jason Gunthorpe wrote:
> > diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
> > index b60687f57bef3b..c360d5a7675921 100644
> > --- a/drivers/iommu/iommufd/selftest.c
> > +++ b/drivers/iommu/iommufd/selftest.c
> > @@ -1342,7 +1342,7 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id,
> >  			      unsigned long page_size, void __user *uptr,
> >  			      u32 flags)
> >  {
> > -	unsigned long bitmap_size, i, max;
> > +	unsigned long i, max;
> >  	struct iommu_test_cmd *cmd = ucmd->cmd;
> >  	struct iommufd_hw_pagetable *hwpt;
> >  	struct mock_iommu_domain *mock;
> > @@ -1363,15 +1363,14 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id,
> >  	}
> >  
> >  	max = length / page_size;
> > -	bitmap_size = DIV_ROUND_UP(max, BITS_PER_BYTE);
> > -
> > -	tmp = kvzalloc(bitmap_size, GFP_KERNEL_ACCOUNT);
> > +	tmp = kvzalloc(DIV_ROUND_UP(max, BITS_PER_LONG) * sizeof(unsigned long),
> 
> If you keep bitmap_size then this gets to be a one-liner patch, but I assume you
> want to remove bitmap_size anyways.

Then we would technically read past the end of the user buffer..

Thanks,
Jason