Re: [PATCH v3] iommu/iommufd: avoid selftest dirty bitmap size wrap

[Jason Gunthorpe]

On Sun, Jun 28, 2026 at 03:23:32PM +0000, Samuel Moelius wrote:
> IOMMU_TEST_OP_DIRTY sizes its temporary dirty bitmap from
> length / page_size.  Very large selftest ranges can make the
> DIV_ROUND_UP() additions wrap before allocation, producing a
> zero-length allocation while the later test_bit() loop still walks the
> original number of bits.
> 
> The selftest helper does not need to support unbounded dirty bitmap
> sizes.  Reject requests whose range cap calculation overflows, or whose
> range exceeds SZ_16M pages, before converting the value to bitmap
> allocation and copy sizes.

I suggested to limit either the length or the kvzalloc to around 16M
as a practical limit

> @@ -1686,6 +1687,8 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id,
>  			      u32 flags)
>  {
>  	unsigned long i, max;
> +	unsigned long max_pages = SZ_16M;
> +	unsigned long max_length;
>  	struct iommu_test_cmd *cmd = ucmd->cmd;
>  	struct iommufd_hw_pagetable *hwpt;
>  	struct mock_iommu_domain *mock;
> @@ -1705,6 +1708,15 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id,
>  		goto out_put;
>  	}
>  
> +	if (check_mul_overflow(max_pages, page_size, &max_length)) {
> +		rc = -EOVERFLOW;
> +		goto out_put;
> +	}
> +	if (length > max_length) {
> +		rc = -EOVERFLOW;
> +		goto out_put;
> +	}

This is some huge number, so big that this breaks the logic on 32 bits.

It just needs this:

+       max = length / page_size;
+       if (max > SZ_16M * BITS_PER_BYTE)
+               return -EOVERFLOW;

At the top where it validates the arguments.

I revised this patch and merged it.

Jason