Commit aaca2aa9 authored by Zhenzhong Duan's avatar Zhenzhong Duan Committed by Jason Gunthorpe
Browse files

iommufd: Fix return value of iommufd_fault_fops_write() 

copy_from_user() may return number of bytes failed to copy, we should
not pass over this number to user space to cheat that write() succeed.
Instead, -EFAULT should be returned.

Link: https://patch.msgid.link/r/20260330030755.12856-1-zhenzhong.duan@intel.com


Cc: stable@vger.kernel.org
Fixes: 07838f7f ("iommufd: Add iommufd fault object")
Signed-off-by: default avatarZhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: default avatarPranjal Shrivastava <praan@google.com>
Reviewed-by: default avatarShuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent 67cb50ae

drivers/iommu/iommufd/eventq.c

+3 −2
Original line number Diff line number Diff line
@@ -187,9 +187,10 @@ static ssize_t iommufd_fault_fops_write(struct file *filep, const char __user *b 


	mutex_lock(&fault->mutex);

	while (count > done) {

		rc = copy_from_user(&response, buf + done, response_size);

		if (rc)

		if (copy_from_user(&response, buf + done, response_size)) {

			rc = -EFAULT;

			break;

		}



		static_assert((int)IOMMUFD_PAGE_RESP_SUCCESS ==

			      (int)IOMMU_PAGE_RESP_SUCCESS);