IOMMU_HWPT_GET_DIRTY_BITMAP can set bits past the end of the bitmap the caller passed in. Two cases, both fixed here.
iova_bitmap_set() does not clip the range it records to the bitmap. When a query ends inside a dirty huge IOPTE, the generic page table code records the whole entry and the bits past the end of the user bitmap are set, up to the end of the last pinned page. The helper is shared with VFIO DMA logging, so the clip covers both users. Patch 1 fixes it and patch 2 tests it. iommufd_check_iova_range() subtracts one from the length before checking it, so iova = 0 with length = 0 is accepted and reaches iova_bitmap_alloc() with length - 1 == SIZE_MAX, a range the clip in patch 1 cannot bound. Patch 3 rejects a zero length and patch 4 tests it. Tested on x86-64 under virtme-ng with CONFIG_IOMMUFD_TEST=y and hugepages=128. Without the fixes the new tests fail: the overrun test finds 56 bytes set past an 8-byte bitmap, and the zero-length query returns success. With the series the iommufd_dirty_tracking fixture passes, the overrun test skipping on the variants without huge IOPTEs. Andrea Parri (4): iommufd/iova_bitmap: Clip recorded ranges to the bitmap iommufd/selftest: Test dirty bitmap recording past the query iommufd: Reject a zero-length dirty bitmap request iommufd/selftest: Test a zero-length dirty bitmap request drivers/iommu/iommufd/io_pagetable.c | 3 ++ drivers/iommu/iommufd/iova_bitmap.c | 27 ++++++++++ tools/testing/selftests/iommu/iommufd.c | 68 +++++++++++++++++++++++++ 3 files changed, 98 insertions(+) base-commit: 54dadb030c7e2350957855d3995de05ae02c2e66 -- 2.53.0
