iommufd/selftest: Add boundary tests for veventq_depth

Test veventq_depth to cover a memory exhaustion vulnerability.

Keep veventq_depth=2 for the existing callers.

Link: https://patch.msgid.link/r/acfa370fa4e89e4626f71954bad7ad2bd64cf63b.1779408671.git.nicolinc@nvidia.com
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c
index d1fe5dbc2813e5c66b40508f36906fa86f32f68b..2e8a27dab0bb8d72a7463519c48e006c6827bd9a 100644 (file)
--- a/tools/testing/selftests/iommu/iommufd.c
+++ b/tools/testing/selftests/iommu/iommufd.c
@@ -2986,11 +2986,26 @@ TEST_F(iommufd_viommu, vdevice_alloc)
                test_err_mock_domain_replace(ENOENT, self->stdev_id,
                                             self->nested_hwpt_id);
 
+               /* Test depth lower and upper bounds (mirrors kernel cap) */
+#define VEVENTQ_MAX_DEPTH (1U << 19)
+               test_err_veventq_alloc(EINVAL, viommu_id,
+                                      IOMMU_VEVENTQ_TYPE_SELFTEST, 0, NULL,
+                                      NULL);
+               test_err_veventq_alloc(EINVAL, viommu_id,
+                                      IOMMU_VEVENTQ_TYPE_SELFTEST,
+                                      VEVENTQ_MAX_DEPTH + 1, NULL, NULL);
+               test_cmd_veventq_alloc(viommu_id, IOMMU_VEVENTQ_TYPE_SELFTEST,
+                                      VEVENTQ_MAX_DEPTH, &veventq_id,
+                                      &veventq_fd);
+               close(veventq_fd);
+               test_ioctl_destroy(veventq_id);
+
                /* Allocate a vEVENTQ with veventq_depth=2 */
                test_cmd_veventq_alloc(viommu_id, IOMMU_VEVENTQ_TYPE_SELFTEST,
-                                      &veventq_id, &veventq_fd);
+                                      2, &veventq_id, &veventq_fd);
                test_err_veventq_alloc(EEXIST, viommu_id,
-                                      IOMMU_VEVENTQ_TYPE_SELFTEST, NULL, NULL);
+                                      IOMMU_VEVENTQ_TYPE_SELFTEST, 2, NULL,
+                                      NULL);
                /* Set vdev_id to 0x99, unset it, and set to 0x88 */
                test_cmd_vdevice_alloc(viommu_id, dev_id, 0x99, &vdev_id);
                test_cmd_mock_domain_replace(self->stdev_id,

diff --git a/tools/testing/selftests/iommu/iommufd_fail_nth.c b/tools/testing/selftests/iommu/iommufd_fail_nth.c
index 45c14323a6183c7887b63e03ed0e59240bc39db9..25495d8dceb3d1355d4d383ed971a73c7ac58ed6 100644 (file)
--- a/tools/testing/selftests/iommu/iommufd_fail_nth.c
+++ b/tools/testing/selftests/iommu/iommufd_fail_nth.c
@@ -712,7 +712,7 @@ TEST_FAIL_NTH(basic_fail_nth, device)
                return -1;
 
        if (_test_cmd_veventq_alloc(self->fd, viommu_id,
-                                   IOMMU_VEVENTQ_TYPE_SELFTEST, &veventq_id,
+                                   IOMMU_VEVENTQ_TYPE_SELFTEST, 2, &veventq_id,
                                    &veventq_fd))
                return -1;
        close(veventq_fd);

diff --git a/tools/testing/selftests/iommu/iommufd_utils.h b/tools/testing/selftests/iommu/iommufd_utils.h
index 5502751d500c895e9ada82657143d6c11a906d61..b4928cbd4d9c8c1edf1923eef24a2e542ab2da03 100644 (file)
--- a/tools/testing/selftests/iommu/iommufd_utils.h
+++ b/tools/testing/selftests/iommu/iommufd_utils.h
@@ -1060,12 +1060,13 @@ static int _test_cmd_hw_queue_alloc(int fd, __u32 viommu_id, __u32 type,
                                              base_addr, len, out_qid))
 
 static int _test_cmd_veventq_alloc(int fd, __u32 viommu_id, __u32 type,
-                                  __u32 *veventq_id, __u32 *veventq_fd)
+                                  __u32 depth, __u32 *veventq_id,
+                                  __u32 *veventq_fd)
 {
        struct iommu_veventq_alloc cmd = {
                .size = sizeof(cmd),
                .type = type,
-               .veventq_depth = 2,
+               .veventq_depth = depth,
                .viommu_id = viommu_id,
        };
        int ret;
@@ -1080,13 +1081,13 @@ static int _test_cmd_veventq_alloc(int fd, __u32 viommu_id, __u32 type,
        return 0;
 }
 
-#define test_cmd_veventq_alloc(viommu_id, type, veventq_id, veventq_fd) \
-       ASSERT_EQ(0, _test_cmd_veventq_alloc(self->fd, viommu_id, type, \
+#define test_cmd_veventq_alloc(viommu_id, type, depth, veventq_id, veventq_fd) \
+       ASSERT_EQ(0, _test_cmd_veventq_alloc(self->fd, viommu_id, type, depth, \
                                             veventq_id, veventq_fd))
-#define test_err_veventq_alloc(_errno, viommu_id, type, veventq_id,     \
-                              veventq_fd)                              \
-       EXPECT_ERRNO(_errno,                                            \
-                    _test_cmd_veventq_alloc(self->fd, viommu_id, type, \
+#define test_err_veventq_alloc(_errno, viommu_id, type, depth, veventq_id,     \
+                              veventq_fd)                                     \
+       EXPECT_ERRNO(_errno,                                                   \
+                    _test_cmd_veventq_alloc(self->fd, viommu_id, type, depth, \
                                             veventq_id, veventq_fd))
 
 static int _test_cmd_trigger_vevents(int fd, __u32 dev_id, __u32 nvevents)