Commit 637ad3a5 authored by David Carlier's avatar David Carlier Committed by Jens Axboe
Browse files

block: don't overwrite bip_vcnt in bio_integrity_copy_user() 



bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce
segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt
on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h
read past the bip_vec[] flex array. On READ the read is in bounds
but lands on a saved user bvec instead of the bounce.

The line was added for split propagation, but bio_integrity_clone()
doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.

Fixes: 3991657a ("block: set bip_vcnt correctly")
Signed-off-by: default avatarDavid Carlier <devnexen@gmail.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511215151.346228-1-devnexen@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 1860c2f8

block/bio-integrity.c

+0 −1
Original line number Diff line number Diff line
@@ -308,7 +308,6 @@ static int bio_integrity_copy_user(struct bio *bio, struct bio_vec *bvec, 
	}



	bip->bip_flags |= BIP_COPY_USER;

	bip->bip_vcnt = nr_vecs;

	return 0;

free_bip:

	bio_integrity_free(bio);