github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-29 17:43:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

iommufd/selftest: Test reserved regions near ULONG_MAX

Browse Source 
This has triggered an overflow inside the ioas iova auto allocation logic,
test it directly. Use the same stimulus syzkaller found.

Link: https://patch.msgid.link/all/2-v1-7b4a16fc390b+10f4-iommufd_alloc_overflow_jgg@nvidia.com/
Tested-by: Yi Liu <yi.l.liu@intel.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
This commit is contained in:
Jason Gunthorpe 2025-07-17 14:59:02 -03:00
parent b42497e3c0
commit 5d8b1d957d
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
tools/testing/selftests/iommu/iommufd.c
View File

@ -968,6 +968,33 @@ TEST_F(iommufd_ioas, area_auto_iova)
test_ioctl_ioas_unmap(iovas[i], PAGE_SIZE * (i + 1));
}
/* https://lore.kernel.org/r/685af644.a00a0220.2e5631.0094.GAE@google.com */
TEST_F(iommufd_ioas, reserved_overflow)
{
struct iommu_test_cmd test_cmd = {
.size = sizeof(test_cmd),
.op = IOMMU_TEST_OP_ADD_RESERVED,
.id = self->ioas_id,
.add_reserved.start = 6,
};
unsigned int map_len;
__u64 iova;
if (PAGE_SIZE == 4096) {
test_cmd.add_reserved.length = 0xffffffffffff8001;
map_len = 0x5000;
} else {
test_cmd.add_reserved.length =
0xffffffffffffffff - MOCK_PAGE_SIZE * 16;
map_len = MOCK_PAGE_SIZE * 10;
}
ASSERT_EQ(0,
ioctl(self->fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_ADD_RESERVED),
&test_cmd));
test_err_ioctl_ioas_map(ENOSPC, buffer, map_len, &iova);
}
TEST_F(iommufd_ioas, area_allowed)
{
struct iommu_test_cmd test_cmd = {