Commit 808471dd authored by Dominique Martinet's avatar Dominique Martinet Committed by Andrew Morton
Browse files

iov_iter: iterate_folioq: fix handling of offset >= folio size 

It's apparently possible to get an iov advanced all the way up to the end
of the current page we're looking at, e.g.

(gdb) p *iter
$24 = {iter_type = 4 '\004', nofault = false, data_source = false, iov_offset = 4096, {__ubuf_iovec = {
      iov_base = 0xffff88800f5bc000, iov_len = 655}, {{__iov = 0xffff88800f5bc000, kvec = 0xffff88800f5bc000,
        bvec = 0xffff88800f5bc000, folioq = 0xffff88800f5bc000, xarray = 0xffff88800f5bc000,
        ubuf = 0xffff88800f5bc000}, count = 655}}, {nr_segs = 2, folioq_slot = 2 '\002', xarray_start = 2}}

Where iov_offset is 4k with 4k-sized folios

This should have been fine because we're only in the 2nd slot and there's
another one after this, but iterate_folioq should not try to map a folio
that skips the whole size, and more importantly part here does not end up
zero (because 'PAGE_SIZE - skip % PAGE_SIZE' ends up PAGE_SIZE and not
zero..), so skip forward to the "advance to next folio" code

Link: https://lkml.kernel.org/r/20250813-iot_iter_folio-v3-0-a0ffad2b665a@codewreck.org
Link: https://lkml.kernel.org/r/20250813-iot_iter_folio-v3-1-a0ffad2b665a@codewreck.org


Signed-off-by: default avatarDominique Martinet <asmadeus@codewreck.org>
Fixes: db0aa2e9 ("mm: Define struct folio_queue and ITER_FOLIOQ to handle a sequence of folios")
Reported-by: default avatarMaximilian Bosch <maximilian@mbosch.me>
Reported-by: default avatarRyan Lahfa <ryan@lahfa.xyz>
Reported-by: default avatarChristian Theune <ct@flyingcircus.io>
Reported-by: default avatarArnout Engelen <arnout@bzzt.net>
Link: https://lkml.kernel.org/r/D4LHHUNLG79Y.12PI0X6BEHRHW@mbosch.me/


Acked-by: default avatarDavid Howells <dhowells@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: <stable@vger.kernel.org>	[6.12+]
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 0cc2a488

include/linux/iov_iter.h

+11 −9
Original line number Diff line number Diff line
@@ -160,7 +160,7 @@ size_t iterate_folioq(struct iov_iter *iter, size_t len, void *priv, void *priv2 


	do {

		struct folio *folio = folioq_folio(folioq, slot);

		size_t part, remain, consumed;

		size_t part, remain = 0, consumed;

		size_t fsize;

		void *base;
@@ -168,6 +168,7 @@ size_t iterate_folioq(struct iov_iter *iter, size_t len, void *priv, void *priv2 
			break;



		fsize = folioq_folio_size(folioq, slot);

		if (skip < fsize) {

			base = kmap_local_folio(folio, skip);

			part = umin(len, PAGE_SIZE - skip % PAGE_SIZE);

			remain = step(base, progress, part, priv, priv2);
@@ -176,6 +177,7 @@ size_t iterate_folioq(struct iov_iter *iter, size_t len, void *priv, void *priv2 
			len -= consumed;

			progress += consumed;

			skip += consumed;

		}

		if (skip >= fsize) {

			skip = 0;

			slot++;