Commit e6a973af authored by Jason Gunthorpe's avatar Jason Gunthorpe
Browse files

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED 

syzkaller found it could overflow math in the test infrastructure and
cause a WARN_ON by corrupting the reserved interval tree. This only
effects test kernels with CONFIG_IOMMUFD_TEST.

Validate the user input length in the test ioctl.

Fixes: f4b20bb3 ("iommufd: Add kernel support for testing iommufd")
Link: https://patch.msgid.link/r/0-v1-cd99f6049ba5+51-iommufd_syz_add_resv_jgg@nvidia.com


Reviewed-by: default avatarSamiullah Khawaja <skhawaja@google.com>
Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Tested-by: default avatarYi Liu <yi.l.liu@intel.com>
Reported-by: default avatar <syzbot+57fdb0cf6a0c5d1f15a2@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/all/69368129.a70a0220.38f243.008f.GAE@google.com


Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent b80fab28

drivers/iommu/iommufd/selftest.c

+7 −1
Original line number Diff line number Diff line
@@ -1184,14 +1184,20 @@ static int iommufd_test_add_reserved(struct iommufd_ucmd *ucmd, 
				     unsigned int mockpt_id,

				     unsigned long start, size_t length)

{

	unsigned long last;

	struct iommufd_ioas *ioas;

	int rc;



	if (!length)

		return -EINVAL;

	if (check_add_overflow(start, length - 1, &last))

		return -EOVERFLOW;



	ioas = iommufd_get_ioas(ucmd->ictx, mockpt_id);

	if (IS_ERR(ioas))

		return PTR_ERR(ioas);

	down_write(&ioas->iopt.iova_rwsem);

	rc = iopt_reserve_iova(&ioas->iopt, start, start + length - 1, NULL);

	rc = iopt_reserve_iova(&ioas->iopt, start, last, NULL);

	up_write(&ioas->iopt.iova_rwsem);

	iommufd_put_object(ucmd->ictx, &ioas->obj);

	return rc;