From nobody Mon Jun 8 05:24:51 2026 Received: from PH7PR06CU001.outbound.protection.outlook.com (mail-westus3azon11010043.outbound.protection.outlook.com [52.101.201.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C3EC3F9293; Mon, 1 Jun 2026 20:43:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.201.43 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346605; cv=fail; b=jni2JT9Ub9xxj3HrjHO7cONVIo3OD9LlVdyQEyp6lFoVorDRzR9WAcNyz5iB5alPq10CyadZKHZB84wtzSUawnoyC2FLULN3hasbeu4jkrRxR/K1vr2oVoSfSb18BRYWqEbM9oa9h7MczGxg3wepRoSSbTk+IyLIu6AU/AvLX+Y= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346605; c=relaxed/simple; bh=MAyfbX8Ix6u/uDaWQ4oIXC8wQYe2NRWHJ3fpGweI+VM=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=RLnd3nHEx4uXrNX/+QTuQ6y4av0bM4m1LPzn9zm3MTCHZ7eKnCASLXku4rvwmNQSidUZy8CEVyuFvNnNiw8N86HHFzOo6+bmcXPD3NpZ5XtJNX8tTMRGOJrOEDHqolbeoseA6uLLwWrVyu5nViTcNS/BFJk0NYPNff50vVblLFY= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=JQU7ZdOD; arc=fail smtp.client-ip=52.101.201.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="JQU7ZdOD" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=CsFTCRwUZIvLDoL/FLiYXHAC7z41OwGPaFbJ6xJelSZQyh2lCycu23NADTfM7udAnrZ298kCAXoHpVmboemH7eJT9pYsc9p/RXYxHYOYGUqXothgvtqNCosIM/3CUe4U0i7VBFql05hT/iBukSXHZT0rDYqjQ+D8stWyZgFCHRc4zPScj3iMLgSF2Se4TxkHjl4KTTMuZDPNqsuTs9zAZtT22zbprczrTzTFaMcQZgLOTi7SFJptO8UO8l1pgikY2IQoXs79MqPZp8V1bDcY4iDOBJtdnL+6LN0DZAVib6K1zTMSUNj+imrVX4/AL9FNNNcFe+wPHN6GGkMEwrGk6w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=lxghXQ21VnD0zRZSQ5LJYt9ab6slKfobkfTj3pdAsG8=; b=Qxbdj74PDHgQ53upcrFRQCen7jOBzn2vjQ0Br2Jq27npwDw3AgIVDtS7noSvHf0fcTP6iMpmWSL7VxqrNrVW9TmSF8ddEne5Hoymd6pmtJgEeZQJ9VOei9Ck6S+rxFUEd4jOYz0X7XW8cNzSCAZ+SsL0COEmS2+QpW0BnM6z4doE4HJ4HjeOAB00/HVvZHGXGNMZXKTMfbKDhjgMzCpKLPBO4kQyuL/sdpmSf9hNXJq9y36cgVeXKtSxy8xgOHfXB3v4m2vfTfrDOQP3DAZ1Pa69metfulkL7fZk0BvhUSsBnI5bDlqz/73v08LO06WqdyAN+ls51SbIpujfQ1BQVw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=intel.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lxghXQ21VnD0zRZSQ5LJYt9ab6slKfobkfTj3pdAsG8=; b=JQU7ZdODMtHky+k70Zz8cW9HliNo8GDYst5npD92wxs6C/mPyBcecXa8JWSfDEZShj4l823XSpIgquY+SAl50Co4I0pQq3LDzTZdUSxdao6dyYxMOnD79+O1o34ESI8Lg++knE7NW4ce8TGmB9qijYTNa0nZ5nUar8H+O0y/hzExTL/xQJtGgX7BLzmkxUnN3nBdVk4zNo/wcYcKtx1U4jVl5gCB8O0MDtxLC5PbOjPkBk5thcwA5G5y8uBmE/g5LrR+hG8k1KhcMNX4MK9mUdlKxLc22RXykljOLEvoDt+Z5lJpVAzSzydB5R+kk5PKthSWopa2Ux33LOlvQt0Y4A== Received: from BL1PR13CA0382.namprd13.prod.outlook.com (2603:10b6:208:2c0::27) by IA0PPF52B16157D.namprd12.prod.outlook.com (2603:10b6:20f:fc04::bce) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.16; Mon, 1 Jun 2026 20:43:16 +0000 Received: from MN1PEPF0000ECD5.namprd02.prod.outlook.com (2603:10b6:208:2c0:cafe::a) by BL1PR13CA0382.outlook.office365.com (2603:10b6:208:2c0::27) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.12 via Frontend Transport; Mon, 1 Jun 2026 20:43:15 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by MN1PEPF0000ECD5.mail.protection.outlook.com (10.167.242.133) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Mon, 1 Jun 2026 20:43:15 +0000 Received: from rnnvmail203.nvidia.com (10.129.68.9) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:52 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail203.nvidia.com (10.129.68.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:52 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.9) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 1 Jun 2026 13:42:51 -0700 From: Nicolin Chen To: , CC: , , , , Subject: [PATCH v1 1/7] iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails Date: Mon, 1 Jun 2026 13:42:32 -0700 Message-ID: <78f8caeb6a5d667a26b870e3068cec47dd4b5be1.1780343944.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MN1PEPF0000ECD5:EE_|IA0PPF52B16157D:EE_ X-MS-Office365-Filtering-Correlation-Id: 64f69deb-4cae-4b81-6bb7-08dec01e67fe X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|1800799024|36860700016|82310400026|18002099003|22082099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: L/C+MGgKF9F/bn8UC6/VQOvFdKKgKST7rlSeiXDvkz9pUcgMVgexDsZ//mYy0eeVNrMXUwTADt74jR/up2Y42wdl35LrburTsWC/ig5N1QPiEE7OkGkx1djmv4mG5D9QrN5S6jbFd72gZAJtugqEepqTXSXQyrbu0LfCf8M0rqXmHFOGqTizWPRaRZ+BkWbjshioRmlSWDvU9ji4ABD7aIMYZ3fzgMOMEYDMTyspugvlmjug5aeVJMmnawo9/DgfUXTwtp37EIdcgZbbeopGc+C3CTbLQup540GVKQy18raPAjR0aeQMCCCrfg6dJgnbVGm41TIv4bOlRk7v9LLF37MQ/g7YrnM5kE4u+KTt/DwvKJXMTTS3SpcMQCWJJia0BgSTG/oJ6TbU0Z9+k9iPj/ho7H9rmvMbiFybR5tM8cl2aN/aYqGp56EQpgyuz9obKCxqU19dmjsQ1DBBqaIztrFPwxHFN9h1IPA1B98gkVEKfAtFYTCju+jV17hTagd+j7pnej+bSOV6Fe4sja/bv9bed4/gUA75C1+QuxBvUHCrcXUYBk641h3dpi+yrCUOqQ9ZYZK0t/EhOVVviSctLCgv0S3awqihj0P3YVlFwBM3zeYYt3Q7CwwcjAfPCtb+RLxfCKi9xDkDPcrSeBOcRsm4oyXikVSGXwROq/9YiWAhizVZNOKuswwYt5tR2tnyw2w0WuD7pdLdyqLtbyBnDu2H3yiggeq/S97lGPudSpw= X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(1800799024)(36860700016)(82310400026)(18002099003)(22082099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: dqquKG8ZK1UOHeUzS6w1m3C4EvZVceYMLP/Obx/+9pZUnt3c9+VU99IB3WtJXRg/gnLZnXSwCz7NOLpOJtBkLNx+avZ1Z618FlnQ5TDXlMBzDs3qY1VEnRdI4SC+8iGrWkmE5R//aRx4O8/+PzC5pRlnqY6jHtFm/sTqa5BafYgxCWIUYf79QYkDexqU/U0Und9g3qf/2LdPcGCzi3gn1TDnbl5zAEnSyaWvOTTtvrh0sZ0yAetjB2eHg+Fr6NKZ+oATFlB+/g5LQ53Vb0zI2oa7h+/YzScB+AGj9Df+sZBNmmXGAmuGiZ/gx64l8xoujpwqzX4q3FZrGvd89vFpFfRwsUaJXhFBoM9Wn/jEkLvhqNCDD+rYl0hFf2Sw2nItTu/843rwBwyM5XGyZ/YGnXKad+xT2sHYFhxW511wZ5WNbf2ZcbWZQUMotPsB2C/I X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2026 20:43:15.7448 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 64f69deb-4cae-4b81-6bb7-08dec01e67fe X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MN1PEPF0000ECD5.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PPF52B16157D Content-Type: text/plain; charset="utf-8" When the first event copy fails, rc =3D -EFAULT will not be reported as done is set to the length of the copied header. Rewind it to report rc correctly. Fixes: e36ba5ab808e ("iommufd: Add IOMMUFD_OBJ_VEVENTQ and IOMMUFD_CMD_VEVE= NTQ_ALLOC") Cc: stable@vger.kernel.org Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava --- drivers/iommu/iommufd/eventq.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c index 1f1e415285b1a..896f45be0d2ee 100644 --- a/drivers/iommu/iommufd/eventq.c +++ b/drivers/iommu/iommufd/eventq.c @@ -336,6 +336,7 @@ static ssize_t iommufd_veventq_fops_read(struct file *f= ilep, char __user *buf, if (cur->data_len && copy_to_user(buf + done, cur->event_data, cur->data_len)) { iommufd_veventq_deliver_restore(veventq, cur); + done -=3D sizeof(*hdr); rc =3D -EFAULT; break; } --=20 2.43.0 From nobody Mon Jun 8 05:24:51 2026 Received: from PH0PR06CU001.outbound.protection.outlook.com (mail-westus3azon11011029.outbound.protection.outlook.com [40.107.208.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36F38369D65; Mon, 1 Jun 2026 20:43:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.208.29 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346603; cv=fail; b=ZXSMA2EldclazMY0rfVSrIX+ajvKa1T7rp8KBIpOjqfK/5yek21F2Q7ReOoTrL+MyYcaL8PTA1B5d9QzAIDYECYe9CGwgUaF0XqoYWpKNtk9U7YtLIGqQkPVJmm3OCAPnYdmONbxX6wI4iPW/BPFtrmoOB0v/2HmYQjobKLPC0M= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346603; c=relaxed/simple; bh=rPGbpREEvX5MFJ1AoA5JgjDtiKDNwdgdFchwkAMM9z0=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=P0oI340cE/+WjndJcP0ODaxR8Ez0r7fRHT/F8eCtxdz8oTTJdIEl/bFyOT3/hXrVHNgDoIWH34KH796bqjVs78nUrj+mUfjbAWIIlXjfwWeEZavPqKdapRFoepYu3Ekc1JLuYxeFKYsKkaxNlOQCyJYUARKKdLJsl4KDhtaUH3E= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=tvRxdu+X; arc=fail smtp.client-ip=40.107.208.29 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="tvRxdu+X" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=hFZ0DlppBZEgWFYedKLGD/4DOmaERn2CjXuS7e1+noDIwNP9QOzCTADIUILjp8SasATEjYY7JORczq2dWJUVjz6DOs4j6dCzwVPmh0qrq+V/zcrSGAG2x9/KrmdWgUjOIrgFmcrt88uDv55xYuMn3pR+kQqyhkCSnlVR9U+m1BhOp/SqPgbuDmaIT2O8I6FfPMTUKUZUPkNyBMOqnFTXxKDA1nju/+Gwi1sXVdBSHTLYayQBB1atWHUNNuBPqHT+U+6sE/qTOLyvGpVTg1xx0FwfXGhpdLMzSEWt1A5XEzZDpAKEErbNdbObN/wto43MVu56k3wK/WQDp8sJqFDpVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=RvlLflHmi9rUB9ew7g0FmtJN6C60Cy0U+0eItX7Oslg=; b=LAvZH49hzoOx9cDLHT2vOlFF+z3kYirXrDQVOOQcR9kHdq8Pu4Pr6rGA8Xi6X4c1XJNor7VCzVEJCR7Wi4rGSoU91vNYKYRaeTwT6379n0/0PFFOIDAejGY3VdQ5DgPWhBvXkW2AFiIsVui8w0UWT145kchnj/8JDwPrQzr75KkUJK5L4mwSFXybnjCvGZz7iS7IZ5xH4cfsZGxSx9F6fEr2vZG3kA1Q2G8MOhRak8LtuJS32gaXAF6QiuuBsOL6owLXsDymCD0bQKYUMuq2/dV+dGfmH3N5pF8++66y1FWlmR75M60eZz/aL/OeWu4y5YDkGj9m4R43SPBcOL7Njw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=intel.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RvlLflHmi9rUB9ew7g0FmtJN6C60Cy0U+0eItX7Oslg=; b=tvRxdu+X9iLgCWngg/BF0B6gt0KCR7tAgZqa+0ASI2MXxsBIltV3AnBXR/3QUN9vDpLXwJbhdo2qZUxJ52Xm46NqJ9EnDYPy4UydTHRqFCxKIcxnmE+tuDXkHtO++sJKXrhv04U+YcjtX2QraT4qyljDQoZ0K6Eafe/DAl7L/UTO0Voe+K6msFpjwN3ezr9jDz1e3/aaDOLiVmimWFy4F0c34IaktT/OT+hzelISbu6vkgyDm7KbzOvgdAU5F7XbxI6FmpS2tyjyqvEZ2cdvBVuZeAbB7/N/8fOAk0gVsJRoH4QCQ03ZJBDJ6SH1hewykCrOsOlWTk/cLw9GNwi5rQ== Received: from MN2PR22CA0018.namprd22.prod.outlook.com (2603:10b6:208:238::23) by MN0PR12MB5857.namprd12.prod.outlook.com (2603:10b6:208:378::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.16; Mon, 1 Jun 2026 20:43:17 +0000 Received: from MN1PEPF0000ECD6.namprd02.prod.outlook.com (2603:10b6:208:238:cafe::d) by MN2PR22CA0018.outlook.office365.com (2603:10b6:208:238::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.16 via Frontend Transport; Mon, 1 Jun 2026 20:43:17 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by MN1PEPF0000ECD6.mail.protection.outlook.com (10.167.242.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Mon, 1 Jun 2026 20:43:17 +0000 Received: from rnnvmail203.nvidia.com (10.129.68.9) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:54 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail203.nvidia.com (10.129.68.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:53 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.9) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 1 Jun 2026 13:42:52 -0700 From: Nicolin Chen To: , CC: , , , , Subject: [PATCH v1 2/7] iommufd: Reject invalid read count in iommufd_veventq_fops_read() Date: Mon, 1 Jun 2026 13:42:33 -0700 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MN1PEPF0000ECD6:EE_|MN0PR12MB5857:EE_ X-MS-Office365-Filtering-Correlation-Id: 95be754d-99c9-4ba4-8ff4-08dec01e6903 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|36860700016|376014|82310400026|22082099003|18002099003|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: Qr2py/xouE7yDWcyodq1iDIqX7gTQJ99TMk8aoDiLmpRVMoYr4pWlg/O86nVPk5roBCiFbZOcLQISVWiISEsFgcVmC1mVgRkzstY7ajIhfq0E97viR67Ft1dWfNTmplMRAO8mT1hIYPYPgS9un7SP+EFiXQoIOjclzMlg5NS3INo1fCDDCvALKuMP9MIsDydl0QoAQFqDfjy/NzoIedb/UvGpByYHpTUzdGTZEKqYu8YXvnl51FnkB6HJQG33TDeD8MZcltmMK9K2uhQOdGmKjTFScuzfe1qgjMwdfSIihswKCuOSu3OfdGY74bOqhpejD4A0nfMKGwouXDyJCw2u/larLRFwVU9idTEQ6mnYP4EeQGbxBGAY2SuPqaqQkNFtg9F+BUW6aS/NDytMlnW14rrmlnhD88PtoSGNxwrEPuatKCTOEn1MiwAJoEHfDch/+Sp8QWiFjHST3fOyQHiQ1e8ygm6dL9qrbJhA9hWGzJb5qBjditkENBSjjg3RyMqYnw1JyKBtr4N/MvIaMNNfnxLCqIvAUuHe59VKjslDqq9FosmMTPb+ws4fkEOBkB+zoyjPflIS33nRAlhbFPMWz5TQSSMoic/L2/gt8m+oqSze2LDYZ9Do4hPaagfcuqZUwjHUZBP78sZpeA3h+UcRIrB9OBDqJ8Qn0jLoIbnMBvN3eRyc7OARHxuOcEI1cYc/KIWRHkuMq0XJMi5eQgtITvz43Ea2lgzejzSunbwx50= X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(36860700016)(376014)(82310400026)(22082099003)(18002099003)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: JMk5uyafn2pM4Dc2hNas5X2BXQOy6A/bEL5TUuoeS7lUuayvcXAKITB/MQDGPEX0fUtUT//EucKRBBP9R1alvkTnN+g7YVIggVylxWS16XDL94KL5/1MqxkapoMOXv4CFW1ogAhnKVQJ7MYEUOm89G/WkNOciutA4+eE87stMtTWOjNEsjTuWm1uowKA1EOygfq/1zFdMnLsl7B/c9HzlVmtiH0A26L0ayWmTn9LTdC2lDL6wA0QCy5S9GlIIVgBGawFyORvzPOi71EidGq/9pJ+jcc8mVKpBVd+MoMm7RANAKvsYrE6ar/cnyYK5kkq7WjxvsDxouJVvG949eEUCMtHvMKJ2wbww/5WUFKMqiyPR7juBhIwyB1uoZ/RLWXpn1a9IjrdfbOjZVyM8QnihuxhsslYnt2kvVJRraq5Owt0bo4eAUYxfgAGvn5Ptc7x X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2026 20:43:17.4655 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 95be754d-99c9-4ba4-8ff4-08dec01e6903 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MN1PEPF0000ECD6.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN0PR12MB5857 Content-Type: text/plain; charset="utf-8" The read count must be large enough to hold a vEVENT header. For a normal vEVENT, it must also hold the trailing data following the header. iommufd_veventq_fops_read() does not validate the count, but returns 0 as if the read had succeeded while leaving the pending event in the queue. Return -EINVAL in both undersize cases. Fixes: e36ba5ab808e ("iommufd: Add IOMMUFD_OBJ_VEVENTQ and IOMMUFD_CMD_VEVE= NTQ_ALLOC") Cc: stable@vger.kernel.org Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava --- drivers/iommu/iommufd/eventq.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c index 896f45be0d2ee..ac485d010a439 100644 --- a/drivers/iommu/iommufd/eventq.c +++ b/drivers/iommu/iommufd/eventq.c @@ -310,6 +310,9 @@ static ssize_t iommufd_veventq_fops_read(struct file *f= ilep, char __user *buf, =20 if (*ppos) return -ESPIPE; + /* Minimum read count is a vEVENT header */ + if (count < sizeof(*hdr)) + return -EINVAL; =20 while ((cur =3D iommufd_veventq_deliver_fetch(veventq))) { /* Validate the remaining bytes against the header size */ @@ -323,6 +326,9 @@ static ssize_t iommufd_veventq_fops_read(struct file *f= ilep, char __user *buf, if (!vevent_for_lost_events_header(cur) && sizeof(*hdr) + cur->data_len > count - done) { iommufd_veventq_deliver_restore(veventq, cur); + /* Read count doesn't fit a single normal vEVENT */ + if (done =3D=3D 0) + rc =3D -EINVAL; break; } =20 --=20 2.43.0 From nobody Mon Jun 8 05:24:51 2026 Received: from CY3PR05CU001.outbound.protection.outlook.com (mail-westcentralusazon11013065.outbound.protection.outlook.com [40.93.201.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BDABB38BF67; Mon, 1 Jun 2026 20:43:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.201.65 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346601; cv=fail; b=V4w5BLKJHHcp5bJZYNrbk5yCK5kgqx7LE5bSmUuQvT+uNZ8hgj11tdhlHXdm+UtmNzU9T5xCHvXaQrOy6XxuqNA60m80TbDQG4QBnerfCceGXISm+PkYT8MBszL2TQuaRJuOTJpVkeB8R7N0CI2tjtBcum7Fg3F+/pzLztrlXag= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346601; c=relaxed/simple; bh=KKiqcYbnuMNWzAHKsDMs9tYOEBqCAA9CbS4SvGktVds=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=TlzUznNEKtwx2Znq9zZFQIWnmJCtjNfhufpbwDTg9lWa87gBUnu/8g3fWbFEs+3+uyreVpaK6RDv5q/nixtjZn0zEbQ9OENferWPmE97PKTtG+tw43UhDQ3gHZmIDr4gVqFIBTQOl7pvpWojihcM6VV3lpOF73CgUeRMs09tagc= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=LBwrGWM1; arc=fail smtp.client-ip=40.93.201.65 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="LBwrGWM1" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=EBGjnX3yWE9rDytVob4adQoWrenfpFwcsxad9saz+AGyh7RQcKvELJ1e78Cs7yYQE50aNIh1I6IYS1a/0mJmm18MIxC9460mQFB+acfSgFiH7tG1T5Fi8YJIFX4SbUknxGLR74K+WDJm09iZJz1H7fBx/lco00TgVnI6jL/f4xBEb144tMK9ja2mo5jgCZ7u2TuE8XfkV2ShGe5/RsJh7ZYMDvB+cVdtn2KQGxYkFLMpYyViWt6hKMcvPscv7jaPXqUMv8hUSZWjLYyUb/JE2Qr4P/jKgBiAtTL/K2lezVjwjWam818gij7y8EYsFmGIChVhNECOFy2z6JRDMUPIGA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=dj5FGcqDG+pkxdR5aW//jfCke3Y1uDHhuV5GZSc9RA0=; b=Guyu8nU204SQJKSeEHngh23hn0iXRlp+QbtUQ0UysPjeDcicMHkJUkomQc/xdGegkHMwwYxbqe1lxUBEa4NislMf2v1LD8kNtdm5Teqi+D94qqAPj5CrA9kOO37lBpYC089S7d/fzWPtFYAd3vPU/8UdYjbp5VBtHe9utSARISm+2kc/ILV9tS2+EU8JQ7pxKiqpTIEQ0leE3z/i/IXx2OL4uC2yCSdB+RrOsCjOu2bXPrFKaM9LBi35qUdiMlniNuGmRF5lJWGJIsyghU1QYfG7bGHtzLsTg9M2R2o3WSlBhXNUAbLbgW3qxHh48HuxUZ1mV+RKDQBwQY2Zrell7A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=intel.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dj5FGcqDG+pkxdR5aW//jfCke3Y1uDHhuV5GZSc9RA0=; b=LBwrGWM1I7TJ0sbavCkuojBszwGwuMFzfBxNzfNfTNMOYd6W5YqFAwh4hZiogm+anuGblN5FVXNyUK1GM1brL+w91Xgl3NHBe7Qo8rKQvrYudvi7D2bD8oEsd9UhBVJosPzacoDTP4kcT7PVQJBpS+3IT5SKEzYdWJCqdmo5YoUrPCqeUHsApWaSW/Tg5ycEPn8XTfZM69ieCTpRKCPONNN9cH3vQN844eRmTw1phhVsPf4Jfd1FtXeSM81BMAcMkLHH1mxWe7sxFDx/+AaNQRjvkkxDZ0ziprFiEvBJC+EO08uv/ZByuex65apMEgdjM6Dr8jYmICcLCu8yd0V7Kw== Received: from CH2PR14CA0050.namprd14.prod.outlook.com (2603:10b6:610:56::30) by MW3PR12MB4379.namprd12.prod.outlook.com (2603:10b6:303:5e::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.15; Mon, 1 Jun 2026 20:43:16 +0000 Received: from DM2PEPF00003FC4.namprd04.prod.outlook.com (2603:10b6:610:56:cafe::5b) by CH2PR14CA0050.outlook.office365.com (2603:10b6:610:56::30) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.16 via Frontend Transport; Mon, 1 Jun 2026 20:43:16 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by DM2PEPF00003FC4.mail.protection.outlook.com (10.167.23.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Mon, 1 Jun 2026 20:43:15 +0000 Received: from rnnvmail203.nvidia.com (10.129.68.9) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:55 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail203.nvidia.com (10.129.68.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:54 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.9) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 1 Jun 2026 13:42:53 -0700 From: Nicolin Chen To: , CC: , , , , Subject: [PATCH v1 3/7] iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() Date: Mon, 1 Jun 2026 13:42:34 -0700 Message-ID: <25d29feac909e36f78c145fa99ef2d4cb7a415da.1780343944.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DM2PEPF00003FC4:EE_|MW3PR12MB4379:EE_ X-MS-Office365-Filtering-Correlation-Id: 9182ab36-b969-4f46-36e8-08dec01e6804 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|36860700016|1800799024|82310400026|18002099003|22082099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: hZAvfsi+qgXzAGmHL5nSbBdIrRXjeeQOoYHtpHenskS2Ln1Hei6CXSnKiMahKg8C0xQfPBUQphSLogcYMe51nYCHh4eLnSa+nTX4cSOZgjync1BTQ07qesTL3qu3u/XebxSVFGUmf6Vul8YvHTEcviFsYmXFwsMO+OxbYd9OJQSeNnoXT0yZ2L/HjLT8FuCD2rj15auXTjA7BHCMfMA2Gcq8Y+YUu7A1XvJyO08mQFx6pxvJmlraTGNqiS8X/aC9sLgevbsCD/PV948nHS77X+SyJB71nWW6loYPg0nbw7ODTK/CQNXIQvgIpY5cJjJe04KWRC/N4EeT7yDh6aDAvNXFkaLRhk+ExkKXKQ8RLTPZ2zTjSQ1sAQisc7lpVhQ3w/guHgpQcI3Y/PSqejZSymOIFHDoqiUBR6jthcX9PZ9X9fkwrHICGUe5e5NpG6xt/uCg2aINpF9C0Fy71nzdBLC8cG5kzhkHvUEmuRDq3yGY7cDzA4xiOz27U3WSJxLZXeRzEiQ1/OCtbohCXCPFPNvXOMAGg03YZ5h+FBr+8hdbmueTgO0gQ0XfC/A3U+DtnMjF338r3o2UdTc3/vTYJF6tgm1lIHJhpRRLYJKdDQyeo6HxkBacOBWeTMt5SQDnlUP+Rw0LX2E+dxHtXu8/KEXrGgpDwb1Zo09vF73/cgeOUhpS2wBMPsq3vusxkNZCVov5mykF3V4W0YOhjy/XSjBWJgNKcVtqUEoqDMdMPlk= X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(36860700016)(1800799024)(82310400026)(18002099003)(22082099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: xcF+RlO6qbMovpSaSqqRk6WB3Xki1AVbHxGbLcM+23XwDuHEOnVf9UX7xhm/gXuH8JttfgkfHLaRAW1cK9JgwywV1RJMlFM4f+/6t+ESn3xcuHyDScg1mUXFABNRT+PV0E0ptnUuNahQ74UyXCjt7LU6tV/pB2P7vagZxxe8E5dHqj+J+IlNhP6AR7sX/6iFgpbLOkGyXqhKG0QrMeVUow0VTvm10jVHlYibBzMO7y6Q64+KeVuBt0J449jI4E1ypmA/XWd1Cs8dA0+3xITLHfU/Mlo9VA/WOMfuOKXXZGM12hkKg0SchkuAe8htTM9Nj4ZjSZjPjmre9KjkZu/L36QiJSt24DBNwnR5w2bEi6OCP0ch/GmdIRo7hdVK2VloRmadw4BN2D2NmkGRNfxFK4fNbB7u+/Oe0n6ZKyzzWvuuDs2Cmw1NnF0pmNq7/rcP X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2026 20:43:15.8485 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 9182ab36-b969-4f46-36e8-08dec01e6804 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM2PEPF00003FC4.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW3PR12MB4379 Content-Type: text/plain; charset="utf-8" When the kzalloc_obj() fails in iommufd_veventq_deliver_fetch(), it returns NULL, falsely advertising to userspace that the queue is empty. Propagate the -ENOMEM properly to the caller. Fixes: e36ba5ab808e ("iommufd: Add IOMMUFD_OBJ_VEVENTQ and IOMMUFD_CMD_VEVE= NTQ_ALLOC") Cc: stable@vger.kernel.org Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava --- drivers/iommu/iommufd/eventq.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c index ac485d010a439..f55d173c59f61 100644 --- a/drivers/iommu/iommufd/eventq.c +++ b/drivers/iommu/iommufd/eventq.c @@ -264,8 +264,10 @@ iommufd_veventq_deliver_fetch(struct iommufd_veventq *= veventq) /* Make a copy of the lost_events_header for copy_to_user */ if (next =3D=3D &veventq->lost_events_header) { vevent =3D kzalloc_obj(*vevent, GFP_ATOMIC); - if (!vevent) + if (!vevent) { + vevent =3D ERR_PTR(-ENOMEM); goto out_unlock; + } } list_del(&next->node); if (vevent) @@ -315,6 +317,12 @@ static ssize_t iommufd_veventq_fops_read(struct file *= filep, char __user *buf, return -EINVAL; =20 while ((cur =3D iommufd_veventq_deliver_fetch(veventq))) { + if (IS_ERR(cur)) { + if (done =3D=3D 0) + rc =3D PTR_ERR(cur); + break; + } + /* Validate the remaining bytes against the header size */ if (done >=3D count || sizeof(*hdr) > count - done) { iommufd_veventq_deliver_restore(veventq, cur); --=20 2.43.0 From nobody Mon Jun 8 05:24:51 2026 Received: from CH5PR02CU005.outbound.protection.outlook.com (mail-northcentralusazon11012004.outbound.protection.outlook.com [40.107.200.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 06C283FBB7E; Mon, 1 Jun 2026 20:43:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.200.4 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346609; cv=fail; b=W7xIXigHdqlX3xMS6Ykh9qzixKeV5EPyjmf3kEkXoleKsJQPj6dSG/hAGAv+rJz1SYUicxMZbwsACaTVvuXBukYOXxZtUYju5oLquW2xbqYyIXkU5qn1sQRs+VyIyGA0zr3ClNnij2Pk4obIHQfvB1ffsdYYtlsFDoN9PPgTIGA= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346609; c=relaxed/simple; bh=KoCNufDtcmtRsNYVkP6lU5PAntWn+8H5mSIsIf1/inM=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=EyQ2fXyzu0rcy8ibdAf8Ev4RCvBGAzffxHfJCasLOsvRjkaDW0PPSxmzGLXZoPEGJT8o97hFZ0il0FbiDQpnBFal3G8rQHs0iasrgy5nEp4p2rVk71vCSN0J5QVKD7LKcsSYYrxESKI1scmTGdh1P0yNdftBHVfICWgjQ38Myrg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=Pewlnnmg; arc=fail smtp.client-ip=40.107.200.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="Pewlnnmg" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MdSAX4n9GS9jV3vIlgxAiDaneiD5Xl+H5jXa+mhW1kSCyPmx7+DJ6kN4nyr4wYcRZS3mpKb8iLRmhn4srffd76KuvfM5bQ8tmEUFpFfh+IHhri360nBxPBb0gxF1guWoPBB1swJ2y9X8ILS1pY6YOTLUosjcXYCfI0uRImzFotBAEBJgc0MsegDstpTT2NMWxdpKWnzzGO0zRP91lY+AE8iSPFkxwrZ+nqxzl432646V1cKE3cfkCJE0SE08iEtosbyzcu/bHFRGJFkHV0QzsdPLGo9F8qWqUnSdDZ13Z1VxeYF0VCcAIeQYFgiaTAxvnC5y5pDJ++RlKP38JraiwA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=VsvGqZLvKH8oUoVM6+07HstqeICCOxwO17y7APtcvm8=; b=N6fXn8o2Mcz/vB/8trYThLq07E2nAowMRgg5MXPMg6eKkQCuOSHtfE89iezPBYBnzRH0adezIb6BchcxgJpKBFkgzAxK4/pD7fpK89TzUfQNu18gJQciwTrJ73Y7U1KUiSmXC6MBiUg2fzb/Mqwmltcug1O7I5f30eGVaR4Fsy9yiRXhhLTGzAYbfkrhayHYZhn9tDf9blI78rtQBas4NmcZ2f4wcIaOx1md2kEntKf96MvjjbrnilcepKPZQOGsizNe5gXEn36/ZiVTl0jWO8/TkEnPOn3xvXNrxBGfS42xUfff7G0YLo2t6ZPg0k0tU5RouL5sXMjDLYOS3es6IQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=intel.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VsvGqZLvKH8oUoVM6+07HstqeICCOxwO17y7APtcvm8=; b=PewlnnmgGbuKaFvKNz2xowr4MpnT+xsKMbS6iH7k9SvqMHXy0vHpXbbOcXOAtmNncoyCYe9htUGBiiHUxxyPblYmOkLk3ByqZy7R2+WoMCrWnyZBr3JbOAA6xDXnL1g3updRgbopKkbvlg4ICq5F4Cf2vy8z6xqOkLJmgQZprX2RQ1XG3DxgMA5yWHg6In8N4MOJDsWNQ8mj4eSjcDn3/h7iaSaDUgVuDb1/WtZl+7Gof3SVcb6hLRsH/jy4qn5tfndOhCEeemcsCIhYKZwKNoN79s9RwFqlnEt4zRca6io/UE4BuEc+sKWZ+oyMKJTD9oHkQmIUHVwUAQx53FrcEQ== Received: from BL1PR13CA0346.namprd13.prod.outlook.com (2603:10b6:208:2c6::21) by IA0PR12MB7698.namprd12.prod.outlook.com (2603:10b6:208:432::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.15; Mon, 1 Jun 2026 20:43:19 +0000 Received: from MN1PEPF0000ECD5.namprd02.prod.outlook.com (2603:10b6:208:2c6:cafe::5) by BL1PR13CA0346.outlook.office365.com (2603:10b6:208:2c6::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.6 via Frontend Transport; Mon, 1 Jun 2026 20:43:19 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by MN1PEPF0000ECD5.mail.protection.outlook.com (10.167.242.133) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Mon, 1 Jun 2026 20:43:19 +0000 Received: from rnnvmail203.nvidia.com (10.129.68.9) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:56 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail203.nvidia.com (10.129.68.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:55 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.9) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 1 Jun 2026 13:42:55 -0700 From: Nicolin Chen To: , CC: , , , , Subject: [PATCH v1 4/7] iommufd: Reject invalid read count in iommufd_fault_fops_read() Date: Mon, 1 Jun 2026 13:42:35 -0700 Message-ID: <85c118a606fbedc5c132a1f5ec223a5ba23b92d2.1780343944.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MN1PEPF0000ECD5:EE_|IA0PR12MB7698:EE_ X-MS-Office365-Filtering-Correlation-Id: 77604a61-cdf6-44fe-273f-08dec01e6a30 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|376014|82310400026|1800799024|22082099003|18002099003|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: ckEO4GrOIzNe8RXLR7kk1/+ACsRgB9tbs5cYzxAwC1rjGvaF0dBMjaHm6rqPrZBjNmg/YLpRVKrmdRI7VCorNxIRAv0EDdewwO/sZQ4NtwR5kfFoLdhg254i+5zlN+oZycPylsTDt3vGMg2lPuDGBcRvMRn2RIKctKKYOeZC0ttnU0Yy1juYCB+UAO4FLt0H9kUSoYpmPewNTDqFqfbExBrhjiPq0IGqA0QNMoYvi7wao04nrcWdKEqrp0aWoU/Rl21ptMTxcDCRw6XfF4oSOgm7Fwg7rJ+7KZ6gKwb7Fs3CcXxjS7JVpY/2VTZ9Uh+bOK0KofSzO/9yP9y0UY6GvoSjuD08lPhfZEmpI+9NJsZnpp+d9ibPdptQBwa8dWKryshRFCzxzNKQj7yBpS3x86GVbbkQtC9LFXHTnT6yQNmtRIcOqyOh/LY1y82I4u0Phd1o+89pFsF8UKA4n0kZPkMEEoEgT46TZN0QGsXEd+BZut4mZd+gIyPMWlAN3dGM6O3hH7f6375IDtMJmGtGcEBpDsLWUWFjoyfjJdZPrP/1j1JJ0p/CagkLrFfBbBchM3Z8LFMT2JbffibE9ZnAusvTuAy4cEqF9G6Ri9a9ExQ4qjZtAEHRPa3qFRt6wd0DzzvdT2gJRGNAu1TPzfzbYkVjm5vnlOZhBN7sQ9wMN+j7NYb5solAIKLbTcpOLdOo/R4W1v80Utz8R0oiL6DEYHfw83po/+fdYgdxbF40v1Q= X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(36860700016)(376014)(82310400026)(1800799024)(22082099003)(18002099003)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 7xw2LYePsgBeWti6n3VYK0/5NplEAAA8cIOLaJBC6FlNvozdIkEKZN+ebqypnvjZIoX1n3/C4ilw6q8/M/VK9ajSpNCt7hRdTecQYbsiO8kLkVFFD2RqnBxzxcsY2TCn2hvIeU3bRUXactWi5PLFmFzvC29FjKTaTTLO9cYet8P/gAzoJS6Sw4XRRvpj9LhQJsx5sC8CJeVnRoXTC2LHKfPPfbGdghM0q9Xzi2MBTXr1iywnIgTc8Yse74BTisYzq8NrtO7f2NkUKtnTexkmOICP8hvZ1Om2Xpe4kjM/eVIkrGHPgFCimNaA25aJDuzp6G2LcDR5TdHQrp3XPLdF5uvPHDioHn+VLdfj/b9u8wt8kahHTxjHWIP+sRCYs8E6EvDHvtedyhi8DGb61bLHQCUnpKVv1AVqqJKCbXow7D5JuNn8InavSkQHs8mt7r6C X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2026 20:43:19.4269 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 77604a61-cdf6-44fe-273f-08dec01e6a30 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MN1PEPF0000ECD5.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PR12MB7698 Content-Type: text/plain; charset="utf-8" The read count must be large enough to hold one fault or a group's faults. iommufd_fault_fops_read() does not validate the count, but returns 0 as if the read had succeeded while leaving the pending fault in the queue. Return -EINVAL in the undersize cases. Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object") Cc: stable@vger.kernel.org Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava --- drivers/iommu/iommufd/eventq.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c index f55d173c59f61..613024ca8f1ff 100644 --- a/drivers/iommu/iommufd/eventq.c +++ b/drivers/iommu/iommufd/eventq.c @@ -142,6 +142,9 @@ static ssize_t iommufd_fault_fops_read(struct file *fil= ep, char __user *buf, if (done >=3D count || group->fault_count * fault_size > count - done) { iommufd_fault_deliver_restore(fault, group); + /* Read count doesn't fit the first fault group */ + if (done =3D=3D 0) + rc =3D -EINVAL; break; } =20 --=20 2.43.0 From nobody Mon Jun 8 05:24:51 2026 Received: from PH7PR06CU001.outbound.protection.outlook.com (mail-westus3azon11010023.outbound.protection.outlook.com [52.101.201.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 582703FB052; Mon, 1 Jun 2026 20:43:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.201.23 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346610; cv=fail; b=MP1aDJU7vEapHnQbpYsV/RgNJXPsZ/z+EaItOUuJA864fwprHuLL0aitZHMeUjI6aNZcek+GVNw0hT1NZRMreyHV5GFciAxETT29QVlbFVbJpsyIOBsfEaYTw3zi1VFrEuHGzXNJ5U1lCyVx/9OH1CBnjzKm1Yaos1fmaIoxEGM= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346610; c=relaxed/simple; bh=l8DRyxc3BEGZ+DtrKLh89xFQrScMLfOWL508uSTYE1g=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=sjr0EqBg0j8ZU06GBoyDeWasxbP+ANW3zIvSs4hzjG4N1XiHs1FoHk5pUYe1xLY+lsnQCmcfdhjtIhIdW/3fTTJ5/COhP6bBup7OojlN/L2DxMxwCw7aH1EWFsw940/vcvB2TVy18YELOkERBwoTfRLgeVZqsdCUQtTPMzC+9Tk= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=HUuY5Adk; arc=fail smtp.client-ip=52.101.201.23 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="HUuY5Adk" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=YtB4OQKezgcjO9y/CdRGW3zURsFv/G4d+G3EajpWw0BTTsnp8lSfSqSWdKbJG6pYrw1aYdDdsbK2r/7kbouXUqCqbcRpkwNH6DOgtcSetA1qQuCGiREuZTxV9xd6/C+HgoMzzimgIjmw395KsMPavkgEpPBw1GUjf5bxRJxfkXpXtXfKClYSQlauo8a3AVrEStj/3gfFCtCNC1F75puIYopGZmoNQwCiZiOW2y/zaEIasEXwOMJ1t+VC7X9uhV+PpvYVgbRs8mT4in2zrCJ7+hgFY5KFemWg6AsMjrIOKizhnb6tQnYNaprauz9Sf7PLxDykOOTE8U9fTUAj6A/l6w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=oHzPqikahsSOHDfoWnamNXsKZE7HD2IguEH+X5fM06s=; b=ydsxPnI/mngGMUf+PZkMpRAdpdQVHTJynbub84Y1JiNQKyVIMR41JmDlx0W0GPxW4xd3RJHo+B1xXgek1WFkXcSfJskxyTcTeZB5idPtYa6QgFNkOAgjtMJKcNGMCRgN/HnHxEcsQfWqJ/yZkFjgVCOYdIbedI31+Hy0nHNbnTw9e0EJMzlF47MzHeoqMr/dbHKBRAbPGXXEHvOKwixA1U64CIZWmN3mZ3E9VaXDX2l9XjEKzPjdvfBDmX7jclvHuL2lzQGssH2Xomrv7PquPWHpFf4c8XCvlexCSyfWebSHozFycs4Lzi2HPoGJ5Kcp+2tsLNv7it1qnwDOHnRkXg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=intel.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oHzPqikahsSOHDfoWnamNXsKZE7HD2IguEH+X5fM06s=; b=HUuY5Adkfz2cx2GmJOuRDCgWeJ5+yjiMMutnJ2zG8huK19sXupwWqZFuzE5Yqy5IbDPfJMD1G06WgWMdbKHREz8DQiGO0MGPTV9jdZSHr+r6DnOrlQu3XmgRcQd5YKq3WqXqvayeA5Fdga1a5cw2KS8Bh4XMoFYp5h6q3CFmLn8dnDsEYMek1LEgArnivVeQAPQubGZBMHv26M/C3AchO25A0RTdiu2An827JhNySzHER315b0HdT7FTdoqBGeZW1BKQqr3wJensgg2uKnUYEeyyP49AObgUDLK7gBO1vsuEbOb4NOCpwp7lwtyAMksG+iNpXg02zXLjlwMkHr1VCQ== Received: from MN2PR22CA0030.namprd22.prod.outlook.com (2603:10b6:208:238::35) by SJ0PR12MB6736.namprd12.prod.outlook.com (2603:10b6:a03:47a::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.15; Mon, 1 Jun 2026 20:43:21 +0000 Received: from MN1PEPF0000ECDB.namprd02.prod.outlook.com (2603:10b6:208:238:cafe::2c) by MN2PR22CA0030.outlook.office365.com (2603:10b6:208:238::35) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.17 via Frontend Transport; Mon, 1 Jun 2026 20:43:21 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by MN1PEPF0000ECDB.mail.protection.outlook.com (10.167.242.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Mon, 1 Jun 2026 20:43:21 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:57 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:56 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.9) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 1 Jun 2026 13:42:56 -0700 From: Nicolin Chen To: , CC: , , , , Subject: [PATCH v1 5/7] iommufd: Break the loop on failure in iommufd_fault_fops_read() Date: Mon, 1 Jun 2026 13:42:36 -0700 Message-ID: <336a9b6e44fe66a24199d3be777c405c85c98622.1780343944.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MN1PEPF0000ECDB:EE_|SJ0PR12MB6736:EE_ X-MS-Office365-Filtering-Correlation-Id: e2fe9f7a-533d-4db8-944a-08dec01e6b22 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|36860700016|82310400026|22082099003|18002099003|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: nucHATeke0wpMyNJBbgGZjMxDllBRZc7kaqe1bsATNAXw+QxMyAlwYcM/iEG4MYLDRRz1jolBC0MJ5ROgWvRybl0V3q/loBZWxoq3657KedlX6mT7xK3gc6omCpgtAFp4a7odAnasKsw8rUvp2f98iRAnN5JYKhqGUnw87n+GXfgDqKh90CnW8wcfDgqL/5seu84sYTiHfL7IH97PAKFeW3xDofB4fBlrX26aZwY+NP0nA+nU+67FPW4C+2CtZdLXaOrNG6a/vQuFXgSNv5DeWRHowGhcmoj3q8CbKKulDq6gq6TjCFhPD7WJM89nybQ63p8t+oGYCnsq4Rz8HhzLDnBXalq6sDyu3xV/mhSj1yxazERYLzUeBu9sQ/ZthhsxDDEdtVBJ/ERt+h52GqRgUfP01d/8Go/6KiQ59wQH9oaH3KcZmer8U4/odK8F6iH2DPGNlr6t3xjv8Q2WM7d56dMTzOIJh47QaPzrM7TnOp0JZREA94il5cMEGHbo92hEzmZHEqjKA9Y8kTfNlVRlLkd7wpedtaTYlcA4CiDKGp2kiYIjbn7d6u7Y5JO6ZFpI4jWlegi5qMs7fKt5FiEAGiRE9LSFILcE/Kyqn977VWY5wJwYdgZvsA7HYXqMWPzvOWQMOXi6Wn1bpWoYUwVp4e23GLElX8swLuSC0y26DZbHWRz0Yqd+6j6WApSOB+sRdMWAOJ4fyqu8fBR76RF7J4sbbvUjN/fsp26MYOPNvc= X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(376014)(36860700016)(82310400026)(22082099003)(18002099003)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: uscitzQ5U4+bvGkQSQgNFlx0yQsNoaUBtWfEpa2IxJB8wE4nJIFW/qEcQHjDmsTl8HIQOPMehn7PY/oB0vAJRV66IDyfJ3wHETNoKLLk/Rhv2tsgZmC6wRksFZrU7IzTqYCUQVHS6oDAIUarAYur/Vtp9RjSe0x/L/G2QXMEy0isCdluZVRfiWjvYP9IfwNUR/eBTemNvCvFIMxCSIFaFIN5HYjQGMyR9u3pfpxo7gliYVyLRcxknGxOHS49H7PEkYwzQCWD5YgGojahSq1qXlN6v4PWTvPUTpOsH5Ey8K99glonkUvQmq8y1APo8AGMaZadtM/SpLMwj6SbJJFKfV6mLqXzUn4t+oQmromN5nuBNrQif4rbRu+kEZ7p9ldae06oreFCmOSqibLsGdVjOGsmwex0I9M7b+Nfc2pkUIbxv5B9RDFgKKF4ypw86ECX X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2026 20:43:21.0109 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e2fe9f7a-533d-4db8-944a-08dec01e6b22 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MN1PEPF0000ECDB.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR12MB6736 Content-Type: text/plain; charset="utf-8" On a copy_to_user() failure inside the inner list_for_each_entry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing copy_to_user() forever, spinning the reader at 100% CPU with fault->mutex held. Check rc after the inner loop and break the outer while as well. Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object") Cc: stable@vger.kernel.org Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava --- drivers/iommu/iommufd/eventq.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c index 613024ca8f1ff..1c010e691f972 100644 --- a/drivers/iommu/iommufd/eventq.c +++ b/drivers/iommu/iommufd/eventq.c @@ -168,6 +168,8 @@ static ssize_t iommufd_fault_fops_read(struct file *fil= ep, char __user *buf, } done +=3D fault_size; } + if (rc) + break; } mutex_unlock(&fault->mutex); =20 --=20 2.43.0 From nobody Mon Jun 8 05:24:51 2026 Received: from CY7PR03CU001.outbound.protection.outlook.com (mail-westcentralusazon11010030.outbound.protection.outlook.com [40.93.198.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E17F73FADE9; Mon, 1 Jun 2026 20:43:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.198.30 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346609; cv=fail; b=J/uj5cv34GRzlE0quQrnGOHz2H4UXsL0ubvMmpyOPtfDztRJjFgqb8PoA5HgXM1mnj89ZGKCvrDOAmmjviuFdI0X75ItPCawE0aMa28f2aE6w05fMaePBaHVA82Tl/VC11IfEz3bPe8EzC/aWvNCyfwouRpU27CIGKJNUZPqCj8= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346609; c=relaxed/simple; bh=x66F3SPoN17phVdjUEix2CjrNPVhEPHU+LP06Yo6O14=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Z/7JBudxVPXXM+IvKo/KQWBsyJib6dK0NpcJ/xca9x+Zd+qLcsWEN7QS2HvssOoAkdE0wY2eCu/hBF7bbIbPjfkfoTNpDK7K4Jzz/MqaHWF49x62irQtFhF4LM9ZLzykDs729AazaIyKw2A11WqbY+ohK4fGoEEQTe21Gtm4Yok= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=ZNERNQu7; arc=fail smtp.client-ip=40.93.198.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="ZNERNQu7" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=wybFYDMB6Op49V0A+37KdyS1QN94zv9uv7R7pMqEUKqNRtiCHGT0KykrxL2D5ZaLVIB7Ax47D/uDoRQPDtjT02H2B0yIqAFJC2GRUk5P2MJwv/+8OPNc8iDMb+EiP3koG6yUULSxCcG8IbHhsEnatf3f8XkZqMjTFlRCWwBL9AnNp1LW69osRKuW1Y5Zz36Ih/So8EsfvZ+1+JAwIzwuHHQAeJAkbQ1yKwcFWE/x8r7CDtapoJbdm69pls2bprWTaeYSy6PKT987yimmOOuEdqzHpOFiGY6+IECCYDlJ3F3tLPmYP3hEtlDYHUC4aHkvVlte7jZUl4IbqGYatF71jw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ogcVoElS9hGgk8JHfrEawWnuwgkLK3A/uiwo/52fZXs=; b=wsFpVlljuAisgLh1l0oGXcYVt6jclGAX7vN2dr4UlAEcIth/I+7GyFm16SxR2BMOVQWT0e/fSKwZTiCMEq6Nua+O2YhevNTQAUrHqW98lboWnfHMJ99OGAw1s0/EpL5l7zfz0xxvzKVPDakMQRTwdCgzFVMvF2ubP2U9mvK+QJetLamUI+wKOD7ZC6jC6J4IA6pkbdunypwhl2dJtRz3eZ0M4P7CFgzBb3v656eRRkZfoy0RDZKPBXIdvCTVrMpy4zRIXZGYArVgdLl4zjEWwt4pAsS7G86OCalkA2bMg8ddSYcj9Bg4F1gloF7Gsjmve0Wc323bo1aEpOoR41Ku7g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=intel.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ogcVoElS9hGgk8JHfrEawWnuwgkLK3A/uiwo/52fZXs=; b=ZNERNQu7zApZ6fXU+CGh/6x+XXFmW4tXwsuqkCLbvi7pddsCuVDqCdHVkKFf5b/M1sJQiWbdmRziHoxlA9eGRzfiPHl7jJJkVbBREwPbHVLMYKzAySHKKamNsopR79wT+oj7ISZQZ2v5RbxwSFghu3D2j5HVf6zwEdsJDsxC1ca5YIYE6AZltY7GGCaPAsqeg4D0j+NxpkwlorjtBsn8XRKs2bverhmSu8mh0oPRVYr4/tjjTjc07yuIiyJdnV6SIkR4FahpI4lmNFUCKBhQBF5fMyjyjkgBAMexjZBSdAy3DivpisXoMFYZhuZFUvTtMOhv+7EY0NhJAxKxo5FFwQ== Received: from BN1PR12CA0014.namprd12.prod.outlook.com (2603:10b6:408:e1::19) by DS0PR12MB6608.namprd12.prod.outlook.com (2603:10b6:8:d0::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.15; Mon, 1 Jun 2026 20:43:23 +0000 Received: from MN1PEPF0000ECDA.namprd02.prod.outlook.com (2603:10b6:408:e1:cafe::39) by BN1PR12CA0014.outlook.office365.com (2603:10b6:408:e1::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.16 via Frontend Transport; Mon, 1 Jun 2026 20:43:22 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by MN1PEPF0000ECDA.mail.protection.outlook.com (10.167.242.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Mon, 1 Jun 2026 20:43:22 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:58 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:57 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.9) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 1 Jun 2026 13:42:57 -0700 From: Nicolin Chen To: , CC: , , , , Subject: [PATCH v1 6/7] iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() Date: Mon, 1 Jun 2026 13:42:37 -0700 Message-ID: <360cab4d4aeccb0bae275a970e2b3c340a71e0e0.1780343944.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MN1PEPF0000ECDA:EE_|DS0PR12MB6608:EE_ X-MS-Office365-Filtering-Correlation-Id: e591d506-38fa-4bd5-e01b-08dec01e6bfd X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|1800799024|36860700016|82310400026|22082099003|18002099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: oNSwJZIUEourbe86ZvZCvh42qU77AnTYWiSVEMD+JG+ebYFsnWwLJV7zGJTWxtVxPi1ZYHx3KBjZDnapZRDH00ZAC3z0pmA7q+sJXFEgNFEXfe7e8hrRtFKSFJr+nQbCh8OFWSPwcobCxCOmwDbfydCKkNswUlPGVFNCixXMqJoL6V/N3x6xDvqR3tHaATsiS0ntw+pgoWlSGYGIXzooKaNHiTJpPYO6N0O2CeRShPSCNariFmyjMTBJfe54OnSXKF0VMOi0A9vc8sb72Xn4xU+oSOToXFmq47Cf24MCTqXleRy6BYn+VYakllw7LB3bw4DBWXRL+FtN/yDzOOX+kdeH3BzlPQ/e25zsnNSHW1Kb1t6ja5m+5gbQQf0hVnwu7G920G6EbXYZ2Q+rkapa8Ml5CcDvDz2jD2b1CFKZWxILKZO4n+LArDTmhe/pFxpRJO8S53naLQiwJCVdKwpL3xYWEGSVGJ11N0ZjxUArsOKlbtVF+EaIZ0pr6CwtqQJRq2VTgYVW45Zr5faj/M5MGn44hAdqucylqGUG+xeeB01S6NZiNfalta1ec2Ye0t0NNRdC/eehtiLhdeQmZuhn6FlYzykE0LkRtD0u6uFhsW8X18pigpn1YlUB1hN9f3j2B+GKy+zK5/qz4Tr6VHMFKYDzVo8o//i94aNFBhzX3XHTlIzq6rcSqcMtyuLwAP5t05ticBzfDy10pZ2uPR83ThR3/fu4c7nv5cPVIrl9BE0= X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(1800799024)(36860700016)(82310400026)(22082099003)(18002099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: GpLCaqTu6Abi7+CbXMkvoCkODgwFcLFU6eGbl1kNXT006Zsui12N0V9f/MnpBApEVinwGT7E2C5Itosskzo/7X0WLOUumv5R2thyM7y7WdaONaStM4/vE452SCmkuxO+eQc2TWXaHOonP7vEUt9uI6qKTdJ2A5dNjc6R9BV8HtWNtg5oNitMnnI3KemfqPNTzPQjlXZjji5g/xZovDP9iyxSZ6RKQE8Hyj4zV7Vo0QrsxH3iz9yfkeORTNd5DLjEQ/pBvYVcTVpDM76cVMBh6f+Db6YM5tSdRHaSkRX+yHuxCfpvMTTnyD22YAkDOvDtroDUvVYmz4Ml52b2nJrGsZXNuZ/DpK0mjKcWz3JjXWfKZaS2DBNwwfHQTKnIWqPs+B7ow05HItez/veNPGPSawyVkBsbCWXxypT8NbByDDDj+9a+ERLG5sZq8XG143Kr X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2026 20:43:22.4688 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e591d506-38fa-4bd5-e01b-08dec01e6bfd X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MN1PEPF0000ECDA.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB6608 Content-Type: text/plain; charset="utf-8" The cookie returned by xa_alloc() in iommufd_fault_fops_read() is per fault group, but the inner copy_to_user() runs per fault inside the group. If a copy fails mid-group, xa_erase clears the cookie and the group is restored to the deliver list, yet done is not rolled back. The function returns the partial byte count, with the successfully copied faults sitting at offsets below done carrying the now-erased cookie. The next read() then re-fetches the group, allocates a fresh cookie, and re-delivers every fault including the ones already copied; userspace sees duplicates carrying the new cookie, and a stale cookie that can never be responded to. Use a local group_done variable that tracks the per-group progress inside the inner loop, and only commit done =3D group_done after the inner loop has finished successfully. On a copy_to_user failure the outer break skips the commit, so done remains at its prior start-of-group baseline; the partial bytes already written past done are undefined to userspace per the read(2) contract, and the next read re-delivers the whole group atomically. Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava --- drivers/iommu/iommufd/eventq.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c index 1c010e691f972..5129e3bf5461c 100644 --- a/drivers/iommu/iommufd/eventq.c +++ b/drivers/iommu/iommufd/eventq.c @@ -139,6 +139,8 @@ static ssize_t iommufd_fault_fops_read(struct file *fil= ep, char __user *buf, =20 mutex_lock(&fault->mutex); while ((group =3D iommufd_fault_deliver_fetch(fault))) { + size_t group_done =3D done; + if (done >=3D count || group->fault_count * fault_size > count - done) { iommufd_fault_deliver_restore(fault, group); @@ -160,16 +162,17 @@ static ssize_t iommufd_fault_fops_read(struct file *f= ilep, char __user *buf, iommufd_compose_fault_message(&iopf->fault, &data, idev, group->cookie); - if (copy_to_user(buf + done, &data, fault_size)) { + if (copy_to_user(buf + group_done, &data, fault_size)) { xa_erase(&fault->response, group->cookie); iommufd_fault_deliver_restore(fault, group); rc =3D -EFAULT; break; } - done +=3D fault_size; + group_done +=3D fault_size; } if (rc) break; + done =3D group_done; } mutex_unlock(&fault->mutex); =20 --=20 2.43.0 From nobody Mon Jun 8 05:24:51 2026 Received: from SN4PR2101CU001.outbound.protection.outlook.com (mail-southcentralusazon11012057.outbound.protection.outlook.com [40.93.195.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5346C3F4128; Mon, 1 Jun 2026 20:43:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.195.57 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346608; cv=fail; b=rgspjgZ3NRjfI1s080a1NZTwieZDu6L3q831ouLzBT361Win2TS+RUyPyQE14BYfmrzWRLsELLbhYGucEQAJNzZ2yXyPzwnsdEKOCbTaJFWV7NYDycmSrxHK4k9/ZTplO/AYOKkDNjBhNVKaqaqVa125jEUXbmglvtPp+4VPVD8= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780346608; c=relaxed/simple; bh=9PRksLTSsRtdwUuPTFPhO8pgdTnYXQSMM8MqU1Ci9uU=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=EvDOgEpSo5Z0fy+BPWPHXdNvKYf0ZwO2Js8yslgkTTNeUf0l7pHuRPxfRr3nQHFtv70Lf4lpFgQvbONuqg74uN4tgE9cvYug8AfKLn2//QRceTSIUw58FgFlaDKaok0CarcVf90+fO+aH5jaNoft8aZlPWGxnUi38IlDmGXMThk= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=Gra2yyVg; arc=fail smtp.client-ip=40.93.195.57 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="Gra2yyVg" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=OlIrBAP8jOSAhaRLhLYQBMOFRKhNTSLaCtjhLsunkhg24LO5ITfROjuPOkZDfnPnHCQbnarqBpflxUc2oGtk4j98AOua6SbCAKOypu+8hmx+5g/1Wjpu1sXF5q14j03q/GDWw+/fb/5vnU35g3JxmY1eT6yWzy2BVAWaxxfvujoFIC4T01QQqp0M8U2bP+31FoXLwgl7EchHdy+8QpjKJBB8GONKjxGyqh43326U4jPT0m3H8IUvLsO0UkcirHcN0pmu+CVuxHCGCSfjX3QGLggzgffU1jbr2t8GUivlRSFaJ3IRQriC7xkDeGWBHvZaxLluq3CKNFSzHFjOAkzMFA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=xSmiSbUJWbMx2WN4bWiju1To11zMSW66yeEf+WXlsII=; b=rn2aWRaGQVIeFPRgZR61WC+qWjEQufUepbp5NHc7eakTa/cpS4R/nTsLF0CftmqjtESAMbgAtJd7n1P9J/RSEqQSDW2t7AUaWZbVOnFXuHSuisd/H5jDoA9c8IhtxlQsx/hAQxEMp2PwJ1HvaN2Qi+By4QrvI5pAehboqvTxn1r1soCE4Ooat8FdH89jsKR+DQV1HNoeW4HSs6Z4AnFM50KDqFGzIu70H8OZOvf7n6NCUWCevGmQx73/GgEJkzFxVJmZ1MMYk45KrURiHzCP9eaIV8BULvUNoIoDEx/PIMmkaKm8UpkfNxuuEUmYpSyDJGbcCbQ8JvPOhGp6I1xSAg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=intel.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xSmiSbUJWbMx2WN4bWiju1To11zMSW66yeEf+WXlsII=; b=Gra2yyVgMCeJROQPu+lRUN+wLxDDXFfVnLMmS5hnH4X8RUpB7d+HTpRkYTpT+/G5WCoyPsn/1j/kn+GJn7CZZnh8z13ah8/w0ROOwBK7FvdK31t4OeotHf2SK+CAKtPkjQQbct9XrMRatYZ3fccgyyngORjwEqBiF9rXroxK8SQ53bjkffXw7cXf6jrHBkicDq2lbHORnZon9tNWFPTkQHiqQQfe28R0BzKy5dYuofXsmuVHltq/tg5e5b9rA4W+SpJjKXJ8qdu25numOpzNWrdwOGXBeJQXrCyUaoSp1IX0Rsen29c+ZArHt353jRJAof/QPrUcH/RMmZpgnTtn6g== Received: from CH2PR16CA0022.namprd16.prod.outlook.com (2603:10b6:610:50::32) by DM4PR12MB7621.namprd12.prod.outlook.com (2603:10b6:8:10a::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.17; Mon, 1 Jun 2026 20:43:20 +0000 Received: from DM2PEPF00003FC5.namprd04.prod.outlook.com (2603:10b6:610:50:cafe::aa) by CH2PR16CA0022.outlook.office365.com (2603:10b6:610:50::32) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.16 via Frontend Transport; Mon, 1 Jun 2026 20:43:20 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by DM2PEPF00003FC5.mail.protection.outlook.com (10.167.23.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Mon, 1 Jun 2026 20:43:20 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:59 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 1 Jun 2026 13:42:58 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.9) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 1 Jun 2026 13:42:58 -0700 From: Nicolin Chen To: , CC: , , , , Subject: [PATCH v1 7/7] iommufd/selftest: Cover invalid read counts on vEVENTQ FD Date: Mon, 1 Jun 2026 13:42:38 -0700 Message-ID: <7bcd153d306f2cf04c094c728c0ebe146855072a.1780343944.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DM2PEPF00003FC5:EE_|DM4PR12MB7621:EE_ X-MS-Office365-Filtering-Correlation-Id: 2b30c1d9-b2fd-488e-59d9-08dec01e6ad4 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|1800799024|376014|6133799003|18002099003|22082099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: wUrnrPTr8iN9+DczT3YaAX9cqyLNYR6BMxjopF/aMIsvu5q816AUqNmM5Sa7yOqalfh7MGCymcO3/FyjAmjzDasGrVqEXYUP+723yZ6wb2Wf8VdRy17I9h749f46u4NaZuuA1yb1F+ELtD9MZFbct6BYePw34QKUH1SRc8EK6zJjTHv3kASp85CRid3whbH6OvuMVxo9OI3mrZRski1USwxc8UcJuxRkWCC5zXWGDNABTcGTvF2P6zzuBTb0efEzvyqgxzvcDOOVe75B0dGYAVeYYkbDIyTpU4Xmzzlbl54ptEiAgrRLFVyXezm7/FxngFYlLDtm7GXPNwB8qJJx2LvnJe86KGqkIqaphio/0Bzft52VhkYcR5Bzv7AJbZk9RB0dR4/HlYXNap2y4H8qlNnNfxOx1aJhewjt1RjzcuRqXRm+d8saWLy34jRIDH6l57rddM8mtZhFF7YJp5koohACBRd+7m1e1Jzm1n+Sa5dNgo6mM7M5BSAzu2lByLnm+zkkJGvhnWt0Fgjy5+zQA8NxQlm90phr/aqgs8T/1YeFWxnpmvyGK8oA4BvVz86aI04U5TWq/0J28sxs3+WpTeYgCflU5fUuZ1+Q6XZYcWplYU/WCkUvg8wpLaxb2VOO6kDXj+MmQQJNDL+1ExFhfiO/+eVRhmt6jSh/MAfAyYgS6aVbSZkDeM30/gwAFYG0hMUsPJZQ4leYeHlRQObz3j4ACpmdyspBELEHFvDTVxY= X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(1800799024)(376014)(6133799003)(18002099003)(22082099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: IK5aXMWL5nSVF4pLUdM4b2VQUhcFXMSXAbitl1y+oLoZTniZMQFLyt5O6cwKEhMKbJtdzDOljMs0mou7oVYOt/Uu5L1IJx3mJzs6qdJVASHZ2eXHesRkJ8s81ywU2OuyDl2eXRBq3gWMR/dWKHwLLL8z8kuBY6T/FDIr7CZhlQMcBXJrKIeKbgoQX17mZUqQOXmfTPiIM7a4P/JvQBDEL0Uc4puLJKEYqgDEAMJsazJlVS+Pb01dL1yNB1nea6bhCAQ3JXYTSrVlYADZwpVSYt2J6010Io8ocyvkhLIj1Iig+ShwVi1u3nfyIDf0G5SfVdw0OrJ8O+rVMjII1LspXpWCVA3N/66n/rVGvKQQhw2heCQ25b/eRNjVFLwFOyufP1rC2vqZHFimBRNK2OzQKWdGjd7uIxr2ZWI7VZpMd+ybOr2pVnkTtN2e173AvlFq X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2026 20:43:20.5545 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2b30c1d9-b2fd-488e-59d9-08dec01e6ad4 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM2PEPF00003FC5.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB7621 Content-Type: text/plain; charset="utf-8" The vEVENTQ file descriptor must reject reads whose buffer cannot hold even one event record. Add selftest coverage that exercises both the empty-queue path (the upfront size check) and the non-empty path (the in-loop check that fires only after an event is fetched). For iommufd_veventq_fops_read(): - count =3D=3D 0 and count < sizeof(header) on an empty vEVENTQ both return -EINVAL. - count =3D=3D 0 and count =3D=3D sizeof(header) on a non-empty vEVENTQ (event has trailing payload) both return -EINVAL. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava --- tools/testing/selftests/iommu/iommufd.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selfte= sts/iommu/iommufd.c index 2e8a27dab0bb8..8d32b2f70beae 100644 --- a/tools/testing/selftests/iommu/iommufd.c +++ b/tools/testing/selftests/iommu/iommufd.c @@ -2980,6 +2980,8 @@ TEST_F(iommufd_viommu, vdevice_alloc) uint32_t veventq_id; uint32_t veventq_fd; int prev_seq =3D -1; + size_t hdr_size =3D sizeof(struct iommufd_vevent_header); + char vbuf[64]; =20 if (dev_id) { /* Must allocate vdevice before attaching to a nested hwpt */ @@ -3006,11 +3008,26 @@ TEST_F(iommufd_viommu, vdevice_alloc) test_err_veventq_alloc(EEXIST, viommu_id, IOMMU_VEVENTQ_TYPE_SELFTEST, 2, NULL, NULL); + + /* Invalid read counts on an empty vEVENTQ */ + ASSERT_EQ(-1, read(veventq_fd, vbuf, 0)); + ASSERT_EQ(EINVAL, errno); + ASSERT_EQ(-1, read(veventq_fd, vbuf, hdr_size - 1)); + ASSERT_EQ(EINVAL, errno); + /* Set vdev_id to 0x99, unset it, and set to 0x88 */ test_cmd_vdevice_alloc(viommu_id, dev_id, 0x99, &vdev_id); test_cmd_mock_domain_replace(self->stdev_id, self->nested_hwpt_id); test_cmd_trigger_vevents(dev_id, 1); + + /* Invalid read counts on a non-empty vEVENTQ */ + ASSERT_EQ(-1, read(veventq_fd, vbuf, 0)); + ASSERT_EQ(EINVAL, errno); + /* header fits but the event's payload doesn't */ + ASSERT_EQ(-1, read(veventq_fd, vbuf, hdr_size)); + ASSERT_EQ(EINVAL, errno); + test_cmd_read_vevents(veventq_fd, 1, 0x99, &prev_seq); test_err_vdevice_alloc(EEXIST, viommu_id, dev_id, 0x99, &vdev_id); --=20 2.43.0