dma: Use correct len type (#479)

* dma: Use correct len type

vfio_iommu_type1_dirty_bitmap_get.size is of type __u64
dma_controller_dirty_page_get() receives it as int, instead it should be u64

Also added UT to test overflow of length passed to dma_controller_dirty_page_get

Fixes: #477

Signed-off-by: Swapnil Ingle <swapnil.ingle@nutanix.com>
Reviewed-by: John Levon <john.levon@nutanix.com>

2 files changed, 8 insertions, 6 deletions

diff --git a/lib/dma.c b/lib/dma.c
index 9b29cc9..32f786b 100644
--- a/lib/dma.c
+++ b/lib/dma.c
@@ -362,7 +362,7 @@ MOCK_DEFINE(dma_controller_add_region)(dma_controller_t *dma,
 
 int
 _dma_addr_sg_split(const dma_controller_t *dma,
-                   vfu_dma_addr_t dma_addr, uint32_t len,
+                   vfu_dma_addr_t dma_addr, uint64_t len,
                    dma_sg_t *sg, int max_sg, int prot)
 {
     int idx;
@@ -377,7 +377,7 @@ _dma_addr_sg_split(const dma_controller_t *dma,
             vfu_dma_addr_t region_end = iov_end(&region->info.iova);
 
             while (dma_addr >= region_start && dma_addr < region_end) {
-                size_t region_len = MIN(region_end - dma_addr, len);
+                size_t region_len = MIN((uint64_t)(region_end - dma_addr), len);
 
                 if (cnt < max_sg) {
                     ret = dma_init_sg(dma, sg, dma_addr, region_len, prot, idx);
@@ -489,7 +489,8 @@ dma_controller_dirty_page_logging_stop(dma_controller_t *dma)
 
 int
 dma_controller_dirty_page_get(dma_controller_t *dma, vfu_dma_addr_t addr,
-                              int len, size_t pgsize, size_t size, char **data)
+                              uint64_t len, size_t pgsize, size_t size,
+                              char **data)
 {
     int ret;
     ssize_t bitmap_size;
diff --git a/lib/dma.h b/lib/dma.h
index b9bf38e..cd17c73 100644
--- a/lib/dma.h
+++ b/lib/dma.h
@@ -128,7 +128,7 @@ MOCK_DECLARE(void, dma_controller_unmap_region, dma_controller_t *dma,
 // Helper for dma_addr_to_sg() slow path.
 int
 _dma_addr_sg_split(const dma_controller_t *dma,
-                   vfu_dma_addr_t dma_addr, uint32_t len,
+                   vfu_dma_addr_t dma_addr, uint64_t len,
                    dma_sg_t *sg, int max_sg, int prot);
 
 static bool
@@ -185,7 +185,7 @@ _dma_mark_dirty(const dma_controller_t *dma, const dma_memory_region_t *region,
 
 static inline int
 dma_init_sg(const dma_controller_t *dma, dma_sg_t *sg, vfu_dma_addr_t dma_addr,
-            uint32_t len, int prot, int region_index)
+            uint64_t len, int prot, int region_index)
 {
     const dma_memory_region_t *const region = &dma->regions[region_index];
 
@@ -316,7 +316,8 @@ dma_controller_dirty_page_logging_stop(dma_controller_t *dma);
 
 int
 dma_controller_dirty_page_get(dma_controller_t *dma, vfu_dma_addr_t addr,
-                              int len, size_t pgsize, size_t size, char **data);
+                              uint64_t len, size_t pgsize, size_t size,
+                              char **data);
 
 #endif /* LIB_VFIO_USER_DMA_H */