Re: [PATCH v1 2/7] iommufd: Reject invalid read count in iommufd_veventq_fops_read()

[Pranjal Shrivastava]

On Mon, Jun 01, 2026 at 01:42:33PM -0700, Nicolin Chen wrote:
> The read count must be large enough to hold a vEVENT header. For a normal
> vEVENT, it must also hold the trailing data following the header.
> 
> iommufd_veventq_fops_read() does not validate the count, but returns 0 as
> if the read had succeeded while leaving the pending event in the queue.
> 
> Return -EINVAL in both undersize cases.
> 
> Fixes: e36ba5ab808e ("iommufd: Add IOMMUFD_OBJ_VEVENTQ and IOMMUFD_CMD_VEVENTQ_ALLOC")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Nicolin Chen <nicolinc@xxxxxxxxxx>

Reviewed-by: Pranjal Shrivastava <praan@xxxxxxxxxx>

Thanks,
Praan