The upper bound of veventq_depth has been missing for veventq allocation,
leaving a vulnerability where userspace could exhaust atomic memory pool.

Fix it properly:
 - Allocate outside the spinlock to avoid GFP_ATOMIC
 - Cap the veventq_depth upper bound
 - Fix event_data byte-count
 - Add selftest coverage

Note that QEMU's SMMU has been already allocating veventq using a "HW"
EVTQ entry number. So, picking 19 as the known use case, for a minimal
level of ABI consistency.

This is on github:
https://github.com/nicolinc/iommufd/commits/fix_veventq_depth-v3

Changelog:
v3
 * Add Reviewed-by from Kevin
 * Update the uAPI header about @veventq_depth limit
v2
 https://lore.kernel.org/all/cover.1779408671.git.nicolinc@nvidia.com/
 * Add Reviewed-by from Jason
 * Rebase on Jason's for-rc tree
 * Update commit message for clarification
 * Move "data_len byte-count" to the first
 * Drop optimistic read in the allocation path
v1
 https://lore.kernel.org/all/cover.1779070992.git.nicolinc@nvidia.com/

Nicolin Chen (4):
  iommufd: Fix data_len byte-count vs element-count mismatch
  iommufd: Move vevent memory allocation outside spinlock
  iommufd: Set veventq_depth upper bound
  iommufd/selftest: Add boundary tests for veventq_depth

 drivers/iommu/iommufd/iommufd_private.h       |  2 +-
 include/uapi/linux/iommufd.h                  |  4 +++-
 tools/testing/selftests/iommu/iommufd_utils.h | 17 +++++++++--------
 drivers/iommu/iommufd/driver.c                | 13 ++++++++-----
 drivers/iommu/iommufd/eventq.c                |  5 ++++-
 tools/testing/selftests/iommu/iommufd.c       | 19 +++++++++++++++++--
 .../selftests/iommu/iommufd_fail_nth.c        |  2 +-
 7 files changed, 43 insertions(+), 19 deletions(-)


base-commit: be93d186ae88a92e7aa77e122d4e661fa57b1e39
-- 
2.43.0

On Mon, May 25, 2026 at 11:51:20AM -0700, Nicolin Chen wrote:
 
> Nicolin Chen (4):
>   iommufd: Fix data_len byte-count vs element-count mismatch
>   iommufd: Move vevent memory allocation outside spinlock
>   iommufd: Set veventq_depth upper bound
>   iommufd/selftest: Add boundary tests for veventq_depth

Applied to for-next

Thanks
Jason

Hi Jason,

On Mon, Jun 01, 2026 at 09:07:54AM -0300, Jason Gunthorpe wrote:
> On Mon, May 25, 2026 at 11:51:20AM -0700, Nicolin Chen wrote:
>  
> > Nicolin Chen (4):
> >   iommufd: Fix data_len byte-count vs element-count mismatch
> >   iommufd: Move vevent memory allocation outside spinlock
> >   iommufd: Set veventq_depth upper bound
> >   iommufd/selftest: Add boundary tests for veventq_depth
> 
> Applied to for-next

Would you please update your remote for-next branch also?

I have a followup series to send. There would be some dependencies
for git-apply and Sashiko review.

Thanks
Nicolin