On Fri, 25 Sep 2026 18:11:36 +0200, Andrea Parri wrote:
> iommufd: Keep IOMMU_HWPT_GET_DIRTY_BITMAP within the user bitmap
>
> IOMMU_HWPT_GET_DIRTY_BITMAP can set bits past the end of the bitmap the
> caller passed in. Two cases, both fixed here.
>
> iova_bitmap_set() does not clip the range it records to the bitmap. When
> a query ends inside a dirty huge IOPTE, the generic page table code
> records the whole entry and the bits past the end of the user bitmap are
> set, up to the end of the last pinned page. The helper is shared with
> VFIO DMA logging, so the clip covers both users. Patch 1 fixes it and
> patch 2 tests it.
>
> [...]
I picked up this patch:
[3/4] iommufd: Reject a zero-length dirty bitmap request
https://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd.git/commit/?id=f6b3fd8f573e801066c21b2aec3d2e949e61e48e
And revised this one:
[1/4] iommufd/iova_bitmap: Clip recorded ranges to the bitmap
https://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd.git/commit/?id=e21952d72b4740f08a272d694cca223b6b0099ca
As discussed.
This test doesn't work after the semantic change:
[2/4] iommufd/selftest: Test dirty bitmap recording past the query
https://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd.git/commit/?id=00ee161c665f9e489bbd53c9185804d12e40d365
And I didn't think this one was so valuable:
[4/4] iommufd/selftest: Test a zero-length dirty bitmap request
https://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd.git/commit/?id=9579527d416d00272a7e3b84330b6fcd9ea8cc31
So I left them out
Thanks,
Jason
