+ cc -O2 -o harness harness.c
-rwxr-xr-x  1 maxx  maxx  8712 Jul 20 20:16 harness
+ ./harness
DF-1919: mrsas_passthru size_t->int truncation in iov_len
  (mrsas_ioctl.c:161 decl, :228 truncation, :241 alloc,
   :255 fw_sge.length, :258 copyin)

  benign                 iov_len=0x0000000000000040 -> ioctl_data_size=64, alloc=64 bytes,
                          fw_sge.length=0x00000040, copyin=64 bytes
                          => heap OVERFLOW = 0 bytes (no overflow)
  truncated-small        iov_len=0x0000000100000008 -> ioctl_data_size=8, alloc=8 bytes,
                          fw_sge.length=0x00000008, copyin=4294967304 bytes
                          => heap OVERFLOW = 4294967296 bytes (ATTACKER-SUPPLIED BYTES PAST ALLOC)
  truncated-page         iov_len=0x0000000100001000 -> ioctl_data_size=4096, alloc=4096 bytes,
                          fw_sge.length=0x00001000, copyin=4294971392 bytes
                          => heap OVERFLOW = 4294967296 bytes (ATTACKER-SUPPLIED BYTES PAST ALLOC)
  truncated-zero-lo      iov_len=0x0000000100000000 -> ioctl_data_size=0, alloc=-1 bytes,
                          fw_sge.length=0x00000000, copyin=4294967296 bytes
                          => heap OVERFLOW = 0 bytes (no overflow)
  truncated-neg          iov_len=0x00000001ffffffff -> ioctl_data_size=-1, alloc=-1 bytes,
                          fw_sge.length=0xffffffff, copyin=8589934591 bytes
                          => heap OVERFLOW = 0 bytes (no overflow)
  truncated-large        iov_len=0x0000000200000800 -> ioctl_data_size=2048, alloc=2048 bytes,
                          fw_sge.length=0x00000800, copyin=8589936640 bytes
                          => heap OVERFLOW = 8589934592 bytes (ATTACKER-SUPPLIED BYTES PAST ALLOC)

  Confirmed: every truncated-small / truncated-page / truncated-large
  case allocates a small DMA buffer (the int-low-32 of iov_len) and then
  issues copyin with the ORIGINAL 64-bit iov_len -> deterministic kernel
  heap overflow with attacker-supplied bytes from mmap'd user memory.
RUN_EXIT=0