From 5391b147d9fd8d4736e28c629cda00fd37c2304a Mon Sep 17 00:00:00 2001 From: Younes Akhouayri Date: Thu, 30 Jul 2026 18:34:38 +0200 Subject: [PATCH] rust: dma: return zero for Coherent reads past EOF MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Coherent::write_to_slice() calculates a zero-byte copy when the file offset is beyond the allocation, but still calls UserSliceWriter::write_dma(). The latter rejects offsets beyond the allocation even when the copy length is zero, so a debugfs read past EOF returns -ERANGE. Return before calling write_dma() when the offset is at or beyond the allocation, matching simple_read_from_buffer() EOF semantics. Fixes: 016818513936 ("rust: dma: implement BinaryWriter for Coherent<[u8]>") Cc: stable@vger.kernel.org Link: https://rust-for-linux.zulipchat.com/#narrow/channel/291566-Library/topic/.E2.9C.94.20Possible.20past-EOF.20bug.20in.20Coherent.3CT.3E.3A.3Awrite_to_slice/near/611677095 Signed-off-by: Younes Akhouayri Reviewed-by: Alexandre Courbot Reviewed-by: Onur Özkan Link: https://patch.msgid.link/20260730-fix-dma-coherent-eof-v2-1-8aff21054afa@younes.io Signed-off-by: Danilo Krummrich --- rust/kernel/dma.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/rust/kernel/dma.rs b/rust/kernel/dma.rs index e275f2562a5b..e8f2bb3631d6 100644 --- a/rust/kernel/dma.rs +++ b/rust/kernel/dma.rs @@ -967,7 +967,11 @@ fn write_to_slice( return Ok(0); }; - let count = self.size().saturating_sub(offset_val).min(writer.len()); + if offset_val >= self.size() { + return Ok(0); + } + + let count = (self.size() - offset_val).min(writer.len()); writer.write_dma(self, offset_val, count)?;