* Re: [PATCH] iommufd: Fix return value of iommufd_fault_fops_write()
2026-03-30 3:07 [PATCH] iommufd: Fix return value of iommufd_fault_fops_write() Zhenzhong Duan
@ 2026-03-30 6:27 ` Shuai Xue
2026-03-30 9:38 ` Pranjal Shrivastava
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Shuai Xue @ 2026-03-30 6:27 UTC (permalink / raw)
To: Zhenzhong Duan, iommu, linux-kernel
Cc: jgg, kevin.tian, joro, will, robin.murphy, baolu.lu, stable
On 3/30/26 11:07 AM, Zhenzhong Duan wrote:
> copy_from_user() may return number of bytes failed to copy, we should
> not pass over this number to user space to cheat that write() succeed.
> Instead, -EFAULT should be returned.
>
> Cc: stable@vger.kernel.org
> Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
> ---
> drivers/iommu/iommufd/eventq.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c
> index f1e686b3a265..710eef0b6004 100644
> --- a/drivers/iommu/iommufd/eventq.c
> +++ b/drivers/iommu/iommufd/eventq.c
> @@ -187,9 +187,10 @@ static ssize_t iommufd_fault_fops_write(struct file *filep, const char __user *b
>
> mutex_lock(&fault->mutex);
> while (count > done) {
> - rc = copy_from_user(&response, buf + done, response_size);
> - if (rc)
> + if (copy_from_user(&response, buf + done, response_size)) {
> + rc = -EFAULT;
> break;
> + }
>
> static_assert((int)IOMMUFD_PAGE_RESP_SUCCESS ==
> (int)IOMMU_PAGE_RESP_SUCCESS);
Good catch.
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Thanks.
Shuai
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] iommufd: Fix return value of iommufd_fault_fops_write()
2026-03-30 3:07 [PATCH] iommufd: Fix return value of iommufd_fault_fops_write() Zhenzhong Duan
2026-03-30 6:27 ` Shuai Xue
@ 2026-03-30 9:38 ` Pranjal Shrivastava
2026-03-31 7:46 ` Tian, Kevin
2026-03-31 16:25 ` Jason Gunthorpe
3 siblings, 0 replies; 5+ messages in thread
From: Pranjal Shrivastava @ 2026-03-30 9:38 UTC (permalink / raw)
To: Zhenzhong Duan
Cc: iommu, linux-kernel, jgg, kevin.tian, joro, will, robin.murphy,
baolu.lu, stable
On Sun, Mar 29, 2026 at 11:07:55PM -0400, Zhenzhong Duan wrote:
> copy_from_user() may return number of bytes failed to copy, we should
> not pass over this number to user space to cheat that write() succeed.
> Instead, -EFAULT should be returned.
>
> Cc: stable@vger.kernel.org
> Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Thanks,
Praan
^ permalink raw reply [flat|nested] 5+ messages in thread* RE: [PATCH] iommufd: Fix return value of iommufd_fault_fops_write()
2026-03-30 3:07 [PATCH] iommufd: Fix return value of iommufd_fault_fops_write() Zhenzhong Duan
2026-03-30 6:27 ` Shuai Xue
2026-03-30 9:38 ` Pranjal Shrivastava
@ 2026-03-31 7:46 ` Tian, Kevin
2026-03-31 16:25 ` Jason Gunthorpe
3 siblings, 0 replies; 5+ messages in thread
From: Tian, Kevin @ 2026-03-31 7:46 UTC (permalink / raw)
To: Duan, Zhenzhong, iommu@lists.linux.dev,
linux-kernel@vger.kernel.org
Cc: jgg@ziepe.ca, joro@8bytes.org, will@kernel.org,
robin.murphy@arm.com, baolu.lu@linux.intel.com,
stable@vger.kernel.org
> From: Duan, Zhenzhong <zhenzhong.duan@intel.com>
> Sent: Monday, March 30, 2026 11:08 AM
>
> copy_from_user() may return number of bytes failed to copy, we should
> not pass over this number to user space to cheat that write() succeed.
> Instead, -EFAULT should be returned.
>
> Cc: stable@vger.kernel.org
> Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] iommufd: Fix return value of iommufd_fault_fops_write()
2026-03-30 3:07 [PATCH] iommufd: Fix return value of iommufd_fault_fops_write() Zhenzhong Duan
` (2 preceding siblings ...)
2026-03-31 7:46 ` Tian, Kevin
@ 2026-03-31 16:25 ` Jason Gunthorpe
3 siblings, 0 replies; 5+ messages in thread
From: Jason Gunthorpe @ 2026-03-31 16:25 UTC (permalink / raw)
To: Zhenzhong Duan
Cc: iommu, linux-kernel, kevin.tian, joro, will, robin.murphy,
baolu.lu, stable
On Sun, Mar 29, 2026 at 11:07:55PM -0400, Zhenzhong Duan wrote:
> copy_from_user() may return number of bytes failed to copy, we should
> not pass over this number to user space to cheat that write() succeed.
> Instead, -EFAULT should be returned.
>
> Cc: stable@vger.kernel.org
> Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
> ---
> drivers/iommu/iommufd/eventq.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
Applied to for-next, thanks
Jason
^ permalink raw reply [flat|nested] 5+ messages in thread