iommufd/selftest: Avoid selftest dirty bitmap size wrap

Browse source

IOMMU_TEST_OP_DIRTY sizes its temporary dirty bitmap from length /
page_size.  Very large selftest ranges can make the DIV_ROUND_UP()
additions wrap before allocation, producing a zero-length allocation while
the later test_bit() loop still walks the original number of bits.

The selftest helper does not need to support unbounded dirty bitmap sizes.
Reject requests that would allocate more than SZ_16M for the temporary
buffer.

Fixes: 79ea4a496a ("iommufd/selftest: Fix buffer read overrrun in the dirty test")
Link: https://patch.msgid.link/r/20260628152331.82122.408afd7b466c.iommufd-test-dirty-bitmap-size-wrap@trailofbits.com
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

...

This commit is contained in:

Samuel Moelius 2026-06-28 15:23:32 +00:00 • committed by Jason Gunthorpe

parent a13c140cc2

commit 4132ba2ae2

1 changed files with 4 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

drivers/iommu/iommufd/selftest.c

View file