On Tue, Oct 25, 2022 at 03:12:19PM -0300, Jason Gunthorpe wrote:
> static struct iommufd_ioctl_op iommufd_ioctl_ops[] = {
> IOCTL_OP(IOMMU_DESTROY, iommufd_destroy, struct iommu_destroy, id),
> + IOCTL_OP(IOMMU_IOAS_ALLOC, iommufd_ioas_alloc_ioctl,
> + struct iommu_ioas_alloc, out_ioas_id),
> + IOCTL_OP(IOMMU_IOAS_ALLOW_IOVAS, iommufd_ioas_allow_iovas,
> + struct iommu_ioas_allow_iovas, allowed_iovas),
> + IOCTL_OP(IOMMU_IOAS_COPY, iommufd_ioas_copy, struct iommu_ioas_copy,
> + src_iova),
> + IOCTL_OP(IOMMU_IOAS_IOVA_RANGES, iommufd_ioas_iova_ranges,
> + struct iommu_ioas_iova_ranges, out_iova_alignment),
> + IOCTL_OP(IOMMU_IOAS_MAP, iommufd_ioas_map, struct iommu_ioas_map,
> + __reserved),
Syzkaller indirectly noticed that __reserved is no longer the last
item in this struct:
IOCTL_OP(IOMMU_IOAS_MAP, iommufd_ioas_map, struct iommu_ioas_map,
- __reserved),
+ iova),
Also added a test to cover basic struct extensibility on all the ioctls.
Jason
