[PATCH 3/7] iommu/arm-smmu-v3-iommufd: Fix error path in arm_vsmmu_cache_invalidate()

[Mostafa Saleh]

arm_vsmmu_cache_invalidate() issues commands in batch size.
However, if arm_vsmmu_convert_user_cmd() fails, it will return to the
user that it processed "cur - cmds" which may be part of a batch not
issued yet.

Fix this by calculating the returned entry_num solely based on the
"last" that tracks the last batch that was successfully issued.

Also, fix the number of commands for early failing condition.

Fixes: d68beb276ba2 ("iommu/arm-smmu-v3: Support IOMMU_HWPT_INVALIDATE using a VIOMMU object")
Reported-by: Sashiko <>
Signed-off-by: Mostafa Saleh <smostafa at google.com>
---
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
index 25982bdbcbd9..91776c555f0e 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
@@ -379,10 +379,13 @@ int arm_vsmmu_cache_invalidate(struct iommufd_viommu *viommu,
 	int ret;
 
 	cmds = kzalloc_objs(*cmds, array->entry_num);
-	if (!cmds)
+	if (!cmds) {
+		array->entry_num = 0;
 		return -ENOMEM;
+	}
 	cur = cmds;
 	end = cmds + array->entry_num;
+	last = cmds;
 
 	static_assert(sizeof(*cmds) == 2 * sizeof(u64));
 	ret = iommu_copy_struct_from_full_user_array(
@@ -391,7 +394,6 @@ int arm_vsmmu_cache_invalidate(struct iommufd_viommu *viommu,
 	if (ret)
 		goto out;
 
-	last = cmds;
 	while (cur != end) {
 		ret = arm_vsmmu_convert_user_cmd(vsmmu, cur);
 		if (ret)
@@ -405,14 +407,12 @@ int arm_vsmmu_cache_invalidate(struct iommufd_viommu *viommu,
 		/* FIXME always uses the main cmdq rather than trying to group by type */
 		ret = __arm_smmu_cmdq_issue_cmdlist(smmu, &smmu->cmdq, &last->cmd,
 						    cur - last, true);
-		if (ret) {
-			cur--;
+		if (ret)
 			goto out;
-		}
 		last = cur;
 	}
 out:
-	array->entry_num = cur - cmds;
+	array->entry_num = last - cmds;
 	kfree(cmds);
 	return ret;
 }
-- 
2.55.0.897.gb25b4bd76c-goog