From nobody Sat Jul 25 20:06:25 2026 Received: from m16.mail.163.com (m16.mail.163.com [220.197.31.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 42E473A2E08 for ; Tue, 14 Jul 2026 02:59:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.197.31.2 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783997999; cv=none; b=U1K57bnXyAULHyr0m1qo8tmme1cwYm32fFEl1/9TU5BBohSC9F6L5WIIOLv3XphtI8dR6wslJGr0O1+rGXBhaZC+AWQG8ny7b4sS6veWJ4eeEvzoZXMghiuIiQDubDf3HSnTGqwzgYKVOp+ClSgVVrleSVB4eJ4xEIhPBMuJCTc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783997999; c=relaxed/simple; bh=U4zm0NbUyWOtwjIaogLD31LYoHgMaECzne8hEE3A+FI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=M5oGgRJa74FboiLdWRZajLbeWwIjAlwoUIY+U/mccMxOjNELCqZSPVXsq+RrqT+wPvzrLkr1Qx3XodrmX9OcF9z2tl5hp5+0c9you92BSp0EbifFb2c52IA/2dQx6/nzj6Zg/57j/7C/If1pY4Kmn0GYYi8Z5DaT9isM4NcDWqo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=J58lV9VP; arc=none smtp.client-ip=220.197.31.2 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="J58lV9VP" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=T5 cE0KN11dI/E52Yvv7eqo+cESpCYIhwJSXgrjLqYyQ=; b=J58lV9VPw/vvkt6724 bNPKPQENki4SxJkJ3wygKCY3ctytfYQ5JQ6g5ynV6I3Ms+BnoGwEVuNM+H3OmsmO I1IaCZKkRwnRRcWRWIz3s5G5UYJ+0N6PTSdnOg93ErHqJAl8zgOzoVpkiUBbpLKf JePPImSFl3kCjIBPNCPNAY4zs= Received: from xwm-TianYi510Pro-14IMB.. (unknown []) by gzga-smtp-mtada-g0-1 (Coremail) with SMTP id _____wD3b_8CplVqBxNXJA--.48351S3; Tue, 14 Jul 2026 10:59:22 +0800 (CST) From: weimin xiong <15927021679@163.com> To: Jean-Philippe Brucker , Joerg Roedel , Will Deacon Cc: Robin Murphy , virtualization@lists.linux.dev, iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Xiong Weimin Subject: [PATCH v1 1/2] iommu/virtio: Set driver data before enabling virtqueues Date: Tue, 14 Jul 2026 10:59:13 +0800 Message-ID: <20260714025914.193580-2-15927021679@163.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260714025914.193580-1-15927021679@163.com> References: <20260714025914.193580-1-15927021679@163.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wD3b_8CplVqBxNXJA--.48351S3 X-Coremail-Antispam: 1Uf129KBjvJXoW7tFyDur1rWF13CFW3XrWxCrg_yoW8Ww43pF 4DCas8GrWjqFyfGa43Jw4UZFWYvwsava4IgFW5Xan5Wr1Ykr90yFy2yFyUtw1xArWkGa1a va48X3ZFyFn8uFJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jseOXUUUUU= X-CM-SenderInfo: jprvmjixqsilmxzbiqqrwthudrp/xtbC0QqbJGpVpgqTpQAA3B Content-Type: text/plain; charset="utf-8" From: Xiong Weimin The event virtqueue callback retrieves the driver state through vq->vdev->priv. viommu_probe() currently initializes that pointer only after virtio_device_ready() and after the event queue is populated. Store the driver data before creating the virtqueues so callbacks always see initialized driver state once the device is made ready. Clear the pointer again on probe failure. Signed-off-by: Xiong Weimin --- drivers/iommu/virtio-iommu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c index 9118377d7..4c91a82d2 100644 --- a/drivers/iommu/virtio-iommu.c +++ b/drivers/iommu/virtio-iommu.c @@ -1173,11 +1173,12 @@ static int viommu_probe(struct virtio_device *vdev) ida_init(&viommu->domain_ids); viommu->dev =3D dev; viommu->vdev =3D vdev; + vdev->priv =3D viommu; INIT_LIST_HEAD(&viommu->requests); =20 ret =3D viommu_init_vqs(viommu); if (ret) - return ret; + goto err_clear_priv; =20 virtio_cread_le(vdev, struct virtio_iommu_config, page_size_mask, &viommu->pgsize_bitmap); @@ -1238,8 +1239,6 @@ static int viommu_probe(struct virtio_device *vdev) if (ret) goto err_free_vqs; =20 - vdev->priv =3D viommu; - ret =3D iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev); if (ret) goto err_remove_sysfs; @@ -1254,6 +1253,7 @@ static int viommu_probe(struct virtio_device *vdev) iommu_device_sysfs_remove(&viommu->iommu); err_free_vqs: vdev->config->del_vqs(vdev); +err_clear_priv: vdev->priv =3D NULL; =20 return ret; --=20 2.43.0 From nobody Sat Jul 25 20:06:25 2026 Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F003739F162 for ; Tue, 14 Jul 2026 02:59:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.3 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783997993; cv=none; b=BY3iqJ/kXWG+FqjVEqh75dOLEMEkA2sxKgeBCAhf/S36yGFQWEgob1WNucr8sKBm/owNL2LJqvZOdo0Ie3NR5SuuGTzskRoVhv42lc+Hn0LiuFO0zUoe0GWKnDNEB3TNs9mPUrOWBY75G7skyU7O0vMTFEjtlZgxZ2g666is6r0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783997993; c=relaxed/simple; bh=rVhO9deu1bdk3yb64ULoUPj80nzZOzHqnrMXjqgLQVk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JOxt7WCxvAZXgX2atxAuhb/WvhWw5PDLuXjgyXqqfP8yDdfXrb6KLqJJQGtkN3bS2dHZ0q84RFM5Ous2S0fTGj0h+rLohiXRsus+ADWV05L1AlNMcw+jxJp8IUE2pVHY9pUC20cJ8JFLRJXcOa0FaraipynYM2fTlPfASDYXmKI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=qVjxkOLj; arc=none smtp.client-ip=117.135.210.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="qVjxkOLj" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=Lh NrACahs4ufRrQbVXxlco155SnB1aDDsdao2QJJ0wI=; b=qVjxkOLjKsrN3LSBiF hi6KCcMKYQJ2s4ZoTzR695HWG8NgUgL37ONGKn/7K5PCxW4WvG+xKVk6Qxh5DBCI QZQgB/FX0YiB+P7mkBiDqmDPUsUY5pYHewte/DYNOj/bR1aiMBf7ExkwlODOIL8f w5kRuB2OozT5lnTA3VnJE4aCs= Received: from xwm-TianYi510Pro-14IMB.. (unknown []) by gzga-smtp-mtada-g0-1 (Coremail) with SMTP id _____wD3b_8CplVqBxNXJA--.48351S4; Tue, 14 Jul 2026 10:59:22 +0800 (CST) From: weimin xiong <15927021679@163.com> To: Jean-Philippe Brucker , Joerg Roedel , Will Deacon Cc: Robin Murphy , virtualization@lists.linux.dev, iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Xiong Weimin Subject: [PATCH v1 2/2] iommu/virtio: Reject short event buffers Date: Tue, 14 Jul 2026 10:59:14 +0800 Message-ID: <20260714025914.193580-3-15927021679@163.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260714025914.193580-1-15927021679@163.com> References: <20260714025914.193580-1-15927021679@163.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wD3b_8CplVqBxNXJA--.48351S4 X-Coremail-Antispam: 1Uf129KBjvdXoWrtr1UXw4fWry7Ary7CrW5Awb_yoWDZFc_ur yvvr9rJr1UZFZ0yryUKr1I9r9aka90vrn3uFWFgrWrJ348Xws7Cryvqrs5GFW7Wr4vkFnI yws0y3WrXryfWjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7IU0fwIDUUUUU== X-CM-SenderInfo: jprvmjixqsilmxzbiqqrwthudrp/xtbC0QqbJGpVpgqTpgAA3C Content-Type: text/plain; charset="utf-8" From: Xiong Weimin viommu_event_handler() only rejects event buffers that are larger than struct viommu_event. A short buffer is also invalid, but the handler would still read evt->head and, for fault events, the rest of evt->fault. Require the used length to match the event buffer size before looking at the event contents. Signed-off-by: Xiong Weimin --- drivers/iommu/virtio-iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c index 4c91a82d2..4b7f0dcfa 100644 --- a/drivers/iommu/virtio-iommu.c +++ b/drivers/iommu/virtio-iommu.c @@ -635,7 +635,7 @@ static void viommu_event_handler(struct virtqueue *vq) struct viommu_dev *viommu =3D vq->vdev->priv; =20 while ((evt =3D virtqueue_get_buf(vq, &len)) !=3D NULL) { - if (len > sizeof(*evt)) { + if (len !=3D sizeof(*evt)) { dev_err(viommu->dev, "invalid event buffer (len %u !=3D %zu)\n", len, sizeof(*evt)); --=20 2.43.0