When the first event copy fails, rc = -EFAULT will not be reported as done
is set to the length of the copied header.

Rewind it to report rc correctly.

Fixes: e36ba5ab808e ("iommufd: Add IOMMUFD_OBJ_VEVENTQ and 
IOMMUFD_CMD_VEVENTQ_ALLOC")
Cc: [email protected]
Signed-off-by: Nicolin Chen <[email protected]>
---
 drivers/iommu/iommufd/eventq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c
index 1f1e415285b1a..896f45be0d2ee 100644
--- a/drivers/iommu/iommufd/eventq.c
+++ b/drivers/iommu/iommufd/eventq.c
@@ -336,6 +336,7 @@ static ssize_t iommufd_veventq_fops_read(struct file 
*filep, char __user *buf,
                if (cur->data_len &&
                    copy_to_user(buf + done, cur->event_data, cur->data_len)) {
                        iommufd_veventq_deliver_restore(veventq, cur);
+                       done -= sizeof(*hdr);
                        rc = -EFAULT;
                        break;
                }
-- 
2.43.0


Reply via email to