Re: [PATCH] vfio/type1: validate dirty bitmap page size before use

[Alex Williamson]

On Wed, 24 Jun 2026 21:12:04 +0200
Yousef Alhouseen <alhouseenyousef@xxxxxxxxx> wrote:

> The dirty bitmap ioctl paths derive a shift with __ffs() from the
> userspace supplied bitmap page size before comparing it with the IOMMU
> page size. A zero page size has undefined behavior, and a non-power-of-2
> value makes the bitmap size check use a different granularity than the
> page size later accepted by the ioctl.
> 
> Reject invalid bitmap page sizes before using them in shift arithmetic.

Thanks for the patch, this is already being worked:

[v1]https://lore.kernel.org/all/20260616111733.1810-1-lirongqing@xxxxxxxxx/
[v2]https://lore.kernel.org/all/20260617113251.2535-1-lirongqing@xxxxxxxxx/

Thanks,
Alex

> Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>
> ---
>  drivers/vfio/vfio_iommu_type1.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
> index c8151ba54..9499381d0 100644
> --- a/drivers/vfio/vfio_iommu_type1.c
> +++ b/drivers/vfio/vfio_iommu_type1.c
> @@ -26,6 +26,7 @@
>  #include <linux/fs.h>
>  #include <linux/highmem.h>
>  #include <linux/iommu.h>
> +#include <linux/log2.h>
>  #include <linux/module.h>
>  #include <linux/mm.h>
>  #include <linux/kthread.h>
> @@ -2949,6 +2950,9 @@ static int vfio_iommu_type1_unmap_dma(struct vfio_iommu *iommu,
>  		if (!access_ok((void __user *)bitmap.data, bitmap.size))
>  			return -EINVAL;
>  
> +		if (!is_power_of_2(bitmap.pgsize))
> +			return -EINVAL;
> +
>  		pgshift = __ffs(bitmap.pgsize);
>  		ret = verify_bitmap_size(unmap.size >> pgshift,
>  					 bitmap.size);
> @@ -3039,6 +3043,9 @@ static int vfio_iommu_type1_dirty_pages(struct vfio_iommu *iommu,
>  			       range.bitmap.size))
>  			return -EINVAL;
>  
> +		if (!is_power_of_2(range.bitmap.pgsize))
> +			return -EINVAL;
> +
>  		pgshift = __ffs(range.bitmap.pgsize);
>  		ret = verify_bitmap_size(size >> pgshift,
>  					 range.bitmap.size);