[PATCH v2] vhost: reject zero-size IOTLB INVALIDATE

From: xiongweimin <[email protected]>

Reject VHOST_IOTLB_INVALIDATE messages with size == 0 to prevent
iova + size - 1 from underflowing to U64_MAX, which would
incorrectly delete the entire IOTLB.

Changes in v2:
- Move the check to vhost_chr_write_iter where similar check for
  VHOST_IOTLB_UPDATE already exists (suggested by Eugenio Perez Martin)
- Add Acked-by from Eugenio Perez Martin

Suggested-by: Eugenio Perez Martin <[email protected]>
Acked-by: Eugenio Perez Martin <[email protected]>
Signed-off-by: xiongweimin <[email protected]>
---
 drivers/vhost/vhost.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 3c080c454..327e1108c 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1716,7 +1716,8 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
 		goto done;
 	}
 
-	if (msg.type == VHOST_IOTLB_UPDATE && msg.size == 0) {
+	if ((msg.type == VHOST_IOTLB_UPDATE ||
+	     msg.type == VHOST_IOTLB_INVALIDATE) && !msg.size) {
 		ret = -EINVAL;
 		goto done;
 	}
--
2.39.3