Re: [PATCH v1 2/2] iommu/virtio: Reject short event buffers

[Will Deacon]

On Tue, Jul 14, 2026 at 10:59:14AM +0800, weimin xiong wrote:
> From: Xiong Weimin <xiongweimin@xxxxxxxxxx>
> 
> viommu_event_handler() only rejects event buffers that are larger than
> struct viommu_event. A short buffer is also invalid, but the handler
> would still read evt->head and, for fault events, the rest of evt->fault.
> 
> Require the used length to match the event buffer size before looking at
> the event contents.
> 
> Signed-off-by: Xiong Weimin <xiongweimin@xxxxxxxxxx>
> ---
>  drivers/iommu/virtio-iommu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
> index 4c91a82d2..4b7f0dcfa 100644
> --- a/drivers/iommu/virtio-iommu.c
> +++ b/drivers/iommu/virtio-iommu.c
> @@ -635,7 +635,7 @@ static void viommu_event_handler(struct virtqueue *vq)
>  	struct viommu_dev *viommu = vq->vdev->priv;
>  
>  	while ((evt = virtqueue_get_buf(vq, &len)) != NULL) {
> -		if (len > sizeof(*evt)) {
> +		if (len != sizeof(*evt)) {
>  			dev_err(viommu->dev,
>  				"invalid event buffer (len %u != %zu)\n",
>  				len, sizeof(*evt));

See Jean-Phillipe's previous reply to an identical patch:

https://lore.kernel.org/all/6800BE0812AF0897+20260706083148.788991-1-raoxu@xxxxxxxxxxxxx/

Will