Commit 79ea4a49 authored by Jason Gunthorpe's avatar Jason Gunthorpe
Browse files

iommufd/selftest: Fix buffer read overrrun in the dirty test 

test_bit() is used to read the memory storing the bitmap, however
test_bit() always uses a unsigned long 8 byte access.

If the bitmap is not an aligned size of 64 bits this will now trigger a
KASAN warning reading past the end of the buffer.

Properly round the buffer allocation to an unsigned long size. Continue to
copy_from_user() using a byte granularity.

Fixes: 9560393b ("iommufd/selftest: Fix iommufd_test_dirty() to handle <u8 bitmaps")
Link: https://patch.msgid.link/r/0-v1-113e8d9e7861+5ae-iommufd_kasan_jgg@nvidia.com


Reviewed-by: default avatarJoao Martins <joao.m.martins@oracle.com>
Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent 1d4684fb

drivers/iommu/iommufd/selftest.c

+4 −5
Original line number Diff line number Diff line
@@ -1343,7 +1343,7 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id, 
			      unsigned long page_size, void __user *uptr,

			      u32 flags)

{

	unsigned long bitmap_size, i, max;

	unsigned long i, max;

	struct iommu_test_cmd *cmd = ucmd->cmd;

	struct iommufd_hw_pagetable *hwpt;

	struct mock_iommu_domain *mock;
@@ -1364,15 +1364,14 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id, 
	}



	max = length / page_size;

	bitmap_size = DIV_ROUND_UP(max, BITS_PER_BYTE);



	tmp = kvzalloc(bitmap_size, GFP_KERNEL_ACCOUNT);

	tmp = kvzalloc(DIV_ROUND_UP(max, BITS_PER_LONG) * sizeof(unsigned long),

		       GFP_KERNEL_ACCOUNT);

	if (!tmp) {

		rc = -ENOMEM;

		goto out_put;

	}



	if (copy_from_user(tmp, uptr, bitmap_size)) {

	if (copy_from_user(tmp, uptr,DIV_ROUND_UP(max, BITS_PER_BYTE))) {

		rc = -EFAULT;

		goto out_free;

	}