diff options
| author | Nicolin Chen <nicolinc@nvidia.com> | 2026-06-01 23:42:35 +0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2026-06-05 17:07:12 +0300 |
| commit | 47916a54eeb2a9e654512ee609f71bd5b29db702 (patch) | |
| tree | c178704bf983e1e98a1b5b5f014c6243f8ed9d66 | |
| parent | 489e63dd120bad52eba63f5506c214750cd5bc75 (diff) | |
| download | linux-47916a54eeb2a9e654512ee609f71bd5b29db702.tar.xz | |
iommufd: Reject invalid read count in iommufd_fault_fops_read()
The read count must be large enough to hold one fault or a group's faults.
iommufd_fault_fops_read() does not validate the count, but returns 0 as if
the read had succeeded while leaving the pending fault in the queue.
Return -EINVAL in the undersize cases.
Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
Link: https://patch.msgid.link/r/85c118a606fbedc5c132a1f5ec223a5ba23b92d2.1780343944.git.nicolinc@nvidia.com
Cc: stable@vger.kernel.org
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
| -rw-r--r-- | drivers/iommu/iommufd/eventq.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c index f55d173c59f6..613024ca8f1f 100644 --- a/drivers/iommu/iommufd/eventq.c +++ b/drivers/iommu/iommufd/eventq.c @@ -142,6 +142,9 @@ static ssize_t iommufd_fault_fops_read(struct file *filep, char __user *buf, if (done >= count || group->fault_count * fault_size > count - done) { iommufd_fault_deliver_restore(fault, group); + /* Read count doesn't fit the first fault group */ + if (done == 0) + rc = -EINVAL; break; } |