superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

iov_iter: iterate_folioq: fix handling of offset >= folio size 

It's apparently possible to get an iov advanced all the way up to the end
of the current page we're looking at, e.g.

(gdb) p *iter
$24 = {iter_type = 4 '\004', nofault = false, data_source = false, iov_offset = 4096, {__ubuf_iovec = {
      iov_base = 0xffff88800f5bc000, iov_len = 655}, {{__iov = 0xffff88800f5bc000, kvec = 0xffff88800f5bc000,
        bvec = 0xffff88800f5bc000, folioq = 0xffff88800f5bc000, xarray = 0xffff88800f5bc000,
        ubuf = 0xffff88800f5bc000}, count = 655}}, {nr_segs = 2, folioq_slot = 2 '\002', xarray_start = 2}}

Where iov_offset is 4k with 4k-sized folios

This should have been fine because we're only in the 2nd slot and there's
another one after this, but iterate_folioq should not try to map a folio
that skips the whole size, and more importantly part here does not end up
zero (because 'PAGE_SIZE - skip % PAGE_SIZE' ends up PAGE_SIZE and not
zero..), so skip forward to the "advance to next folio" code

Link: https://lkml.kernel.org/r/20250813-iot_iter_folio-v3-0-a0ffad2b665a@codewreck.org
Link: https://lkml.kernel.org/r/20250813-iot_iter_folio-v3-1-a0ffad2b665a@codewreck.org
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Fixes: db0aa2e956 ("mm: Define struct folio_queue and ITER_FOLIOQ to handle a sequence of folios")
Reported-by: Maximilian Bosch <maximilian@mbosch.me>
Reported-by: Ryan Lahfa <ryan@lahfa.xyz>
Reported-by: Christian Theune <ct@flyingcircus.io>
Reported-by: Arnout Engelen <arnout@bzzt.net>
Link: https://lkml.kernel.org/r/D4LHHUNLG79Y.12PI0X6BEHRHW@mbosch.me/
Acked-by: David Howells <dhowells@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: <stable@vger.kernel.org>	[6.12+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
pull/1322/head
Dominique Martinet 2025-08-13 15:04:55 +09:00 committed by Andrew Morton
parent 0cc2a4880c
commit 808471ddb0
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
include/linux/iov_iter.h
View File

@ -160,7 +160,7 @@ size_t iterate_folioq(struct iov_iter *iter, size_t len, void *priv, void *priv2
do { do {
struct folio *folio = folioq_folio(folioq, slot); struct folio *folio = folioq_folio(folioq, slot);
size_t part, remain, consumed; size_t part, remain = 0, consumed;
size_t fsize; size_t fsize;
void *base; void *base;
@ -168,14 +168,16 @@ size_t iterate_folioq(struct iov_iter *iter, size_t len, void *priv, void *priv2
break; break;
fsize = folioq_folio_size(folioq, slot); fsize = folioq_folio_size(folioq, slot);
base = kmap_local_folio(folio, skip); if (skip < fsize) {
part = umin(len, PAGE_SIZE - skip % PAGE_SIZE); base = kmap_local_folio(folio, skip);
remain = step(base, progress, part, priv, priv2); part = umin(len, PAGE_SIZE - skip % PAGE_SIZE);
kunmap_local(base); remain = step(base, progress, part, priv, priv2);
consumed = part - remain; kunmap_local(base);
len -= consumed; consumed = part - remain;
progress += consumed; len -= consumed;
skip += consumed; progress += consumed;
skip += consumed;
}
if (skip >= fsize) { if (skip >= fsize) {
skip = 0; skip = 0;
slot++; slot++;