[PATCH v2] iommu: Honor iommufd uapi for zero entry_num args

[PATCH v2] iommu: Honor iommufd uapi for zero entry_num args

[Pranjal Shrivastava]

The IOMMU_HWPT_INVALIDATE ioctl uAPI explicitly allows an empty
invalidation request array by setting entry_num == 0. The uAPI
documentation in include/uapi/linux/iommufd.h mentions:

  " An empty invalidation request array by setting @entry_num==0
    is allowed, and @entry_len and @data_uptr would be ignored in
    this case."

While the core iommufd_hwpt_invalidate() handler honors this by
skipping its bounds checks, the generic array copy helper
iommu_copy_struct_from_full_user_array() still rejects it by
returning -EINVAL, forcing arm_vsmmu_cache_invalidate() to
special-case it.

Return 0 instead of -EINVAL when entry_num is 0 and drop the now
redundant checks in arm_vsmmu_cache_invalidate().

Signed-off-by: Pranjal Shrivastava <praan@google.com>
---
 .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c   | 15 +++++----------
 include/linux/iommu.h                             |  5 +++--
 2 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
index ab1078a97d80..74210867f204 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
@@ -491,15 +491,6 @@ int arm_vsmmu_cache_invalidate(struct iommufd_viommu *viommu,
 
 	static_assert(sizeof(*cmds) == 2 * sizeof(u64));
 
-	if (array->type != IOMMU_VIOMMU_INVALIDATE_DATA_ARM_SMMUV3) {
-		ret = -EINVAL;
-		goto out;
-	}
-
-	/* A zero-length array only probes the type, validated above */
-	if (!array->entry_num)
-		return 0;
-
 	/*
 	 * The core re-invokes this op for the remaining requests, so copy one
 	 * cmdq batch worth of commands into a fixed on-stack buffer rather than
@@ -509,7 +500,11 @@ int arm_vsmmu_cache_invalidate(struct iommufd_viommu *viommu,
 	ret = iommu_copy_struct_from_full_user_array(
 		cmds, sizeof(*cmds), &batch,
 		IOMMU_VIOMMU_INVALIDATE_DATA_ARM_SMMUV3);
-	if (ret)
+	/*
+	 * A zero-length array only probes the data type, which the copy has
+	 * validated; skip issuing a bare CMD_SYNC for it.
+	 */
+	if (ret || !batch.entry_num)
 		goto out;
 
 	/*
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index 05f7cee1375e..5b5e82b21d0b 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -556,7 +556,8 @@ static inline int __iommu_copy_struct_from_user_array(
  * @data_type: The data type of the @kdst. Must match with @user_array->type
  *
  * Copy the entire user array. kdst must have room for kdst_entry_size *
- * user_array->entry_num bytes. Return 0 for success, otherwise -error.
+ * user_array->entry_num bytes. An empty array copies nothing, though its
+ * @data_type is still validated. Return 0 for success, otherwise -error.
  */
 static inline int
 iommu_copy_struct_from_full_user_array(void *kdst, size_t kdst_entry_size,
@@ -569,7 +570,7 @@ iommu_copy_struct_from_full_user_array(void *kdst, size_t kdst_entry_size,
 	if (user_array->type != data_type)
 		return -EINVAL;
 	if (!user_array->entry_num)
-		return -EINVAL;
+		return 0;
 	if (likely(user_array->entry_len == kdst_entry_size)) {
 		if (copy_from_user(kdst, user_array->uptr,
 				   user_array->entry_num *
-- 
2.56.0.567.gdb80ae8cd5-goog

Re: [PATCH v2] iommu: Honor iommufd uapi for zero entry_num args

[Nicolin Chen]

On Thu, Nov 12, 2026 at 03:10:39PM +0000, Pranjal Shrivastava wrote:
> @@ -556,7 +556,8 @@ static inline int __iommu_copy_struct_from_user_array(
>   * @data_type: The data type of the @kdst. Must match with @user_array->type
>   *
>   * Copy the entire user array. kdst must have room for kdst_entry_size *
> - * user_array->entry_num bytes. Return 0 for success, otherwise -error.
> + * user_array->entry_num bytes. An empty array copies nothing, though its
> + * @data_type is still validated. Return 0 for success, otherwise -error.
>   */
>  static inline int
>  iommu_copy_struct_from_full_user_array(void *kdst, size_t kdst_entry_size,
> @@ -569,7 +570,7 @@ iommu_copy_struct_from_full_user_array(void *kdst, size_t kdst_entry_size,
>  	if (user_array->type != data_type)
>  		return -EINVAL;
>  	if (!user_array->entry_num)
> -		return -EINVAL;
> +		return 0;

TBH, this doesn't seem very necessary..

Though I don't have a problem so long as Jason is okay with it..

Yet, this alone would make things inconsistent:
 * The other caller in iommufd selftest isn't updated.
 * __iommu_copy_struct_from_user_array still rejects !entry_num,
   and its callers (intel and selftest) aren't updated either.

Also, please don't omit "linux-kernel@vger.kernel.org" when sending
a patch, as linux-iommu doesn't trigger Sashiko scan.

Nicolin