]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
iommufd: Fix data_len byte-count vs element-count mismatch
authorNicolin Chen <nicolinc@nvidia.com>
Fri, 22 May 2026 00:36:32 +0000 (17:36 -0700)
committerJason Gunthorpe <jgg@nvidia.com>
Mon, 1 Jun 2026 17:54:18 +0000 (14:54 -0300)
commit85345becfead3255a5f875d4b4d82ea01d926239
tree68db43233c953b8d3efa7a74bf5ce6a175874c8f
parentbe93d186ae88a92e7aa77e122d4e661fa57b1e39
iommufd: Fix data_len byte-count vs element-count mismatch

kzalloc_flex() computes the allocation size. With event_data typed as u64,
data_len is interpreted as a u64 element count. Yet, every caller and the
read path treat data_len as a byte count. The current code over-allocates
by sizeof(u64) and the __counted_by() annotation overstates the length by
the same factor.

Re-type event_data as u8. No functional change in user-visible behavior.

Fixes: e36ba5ab808e ("iommufd: Add IOMMUFD_OBJ_VEVENTQ and IOMMUFD_CMD_VEVENTQ_ALLOC")
Link: https://patch.msgid.link/r/f7665f839b9dce917d6bd394375a1cf56568d86b.1779408671.git.nicolinc@nvidia.com
Cc: stable@vger.kernel.org
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/iommu/iommufd/iommufd_private.h