Re: [PATCH v1 1/7] iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails

[Pranjal Shrivastava]

On Mon, Jun 01, 2026 at 01:42:32PM -0700, Nicolin Chen wrote:
> When the first event copy fails, rc = -EFAULT will not be reported as done
> is set to the length of the copied header.
> 
> Rewind it to report rc correctly.
> 
> Fixes: e36ba5ab808e ("iommufd: Add IOMMUFD_OBJ_VEVENTQ and IOMMUFD_CMD_VEVENTQ_ALLOC")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Nicolin Chen <nicolinc@xxxxxxxxxx>
> ---
>  drivers/iommu/iommufd/eventq.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c
> index 1f1e415285b1a..896f45be0d2ee 100644
> --- a/drivers/iommu/iommufd/eventq.c
> +++ b/drivers/iommu/iommufd/eventq.c
> @@ -336,6 +336,7 @@ static ssize_t iommufd_veventq_fops_read(struct file *filep, char __user *buf,
>  		if (cur->data_len &&
>  		    copy_to_user(buf + done, cur->event_data, cur->data_len)) {
>  			iommufd_veventq_deliver_restore(veventq, cur);
> +			done -= sizeof(*hdr);
>  			rc = -EFAULT;
>  			break;
>  		}

Reviewed-by: Pranjal Shrivastava <praan@xxxxxxxxxx>

Thanks,
Praan