Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

vhost: vringh: Fix copy_to_iter return value check

The return value of copy_to_iter can't be negative, check whether the
copied length is equal to the requested length instead of checking for
negative values.

Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
Cc: "Stefano Garzarella" <sgarzare@redhat.com>
Cc: zhang jiao <zhangjiao2@cmss.chinamobile.com>
Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com
Message-ID: <cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

+4 -3
+4 -3
drivers/vhost/vringh.c
··· 1162 1162 struct iov_iter iter; 1163 1163 u64 translated; 1164 1164 int ret; 1165 + size_t size; 1165 1166 1166 1167 ret = iotlb_translate(vrh, (u64)(uintptr_t)dst, 1167 1168 len - total_translated, &translated, ··· 1180 1179 translated); 1181 1180 } 1182 1181 1183 - ret = copy_to_iter(src, translated, &iter); 1184 - if (ret < 0) 1185 - return ret; 1182 + size = copy_to_iter(src, translated, &iter); 1183 + if (size != translated) 1184 + return -EFAULT; 1186 1185 1187 1186 src += translated; 1188 1187 dst += translated;