On Thu, Jul 16, 2026 at 5:02 AM Weimin Xiong <[email protected]> wrote: > > From: xiongweimin <[email protected]> > > Reject unmap requests with size == 0 to prevent iova + size - 1 > from underflowing to U64_MAX, which would incorrectly unmap the > entire IOTLB range. > > This fix also covers the error rollback path in vhost_vdpa_va_map: > when the first VMA lookup fails, map_iova equals iova, resulting > in a zero-size unmap that would otherwise clear the whole IOTLB. > > Signed-off-by: xiongweimin <[email protected]>
Acked-by: Eugenio Pérez <[email protected]> Thanks! > --- > drivers/vhost/vdpa.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c > index bb96b1aa5..f49bf1cfb 100644 > --- a/drivers/vhost/vdpa.c > +++ b/drivers/vhost/vdpa.c > @@ -1035,6 +1035,9 @@ static void vhost_vdpa_unmap(struct vhost_vdpa *v, > const struct vdpa_config_ops *ops = vdpa->config; > u32 asid = iotlb_to_asid(iotlb); > > + if (!size) > + return; > + > vhost_vdpa_iotlb_unmap(v, iotlb, iova, iova + size - 1, asid); > > if (ops->set_map) { > -- > 2.39.3 >
