linux-kernel - [PATCH] drbd: swap bvec_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed,  6 Sep 2023 15:30:34 +0200
From:   Christoph Böhmwalder 
        <christoph.boehmwalder@...bit.com>
To:     Jens Axboe <axboe@...nel.dk>
Cc:     drbd-dev@...ts.linbit.com, linux-kernel@...r.kernel.org,
        Lars Ellenberg <lars.ellenberg@...bit.com>,
        Philipp Reisner <philipp.reisner@...bit.com>,
        linux-block@...r.kernel.org,
        Linux regression tracking <regressions@...mhuis.info>,
        Serguei Ivantsov <manowar@...-game.com>,
        David Howells <dhowells@...hat.com>,
        Christoph Böhmwalder 
        <christoph.boehmwalder@...bit.com>, stable@...r.kernel.org
Subject: [PATCH] drbd: swap bvec_set_page len and offset

bvec_set_page has the following signature:

static inline void bvec_set_page(struct bio_vec *bv, struct page *page,
		unsigned int len, unsigned int offset)

However, the usage in DRBD swaps the len and offset parameters. This
leads to a bvec with length=0 instead of the intended length=4096, which
causes sock_sendmsg to return -EIO.

This leaves DRBD unable to transmit any pages and thus completely
broken.

Swapping the parameters fixes the regression.

Fixes: eeac7405c735 ("drbd: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage()")
Reported-by: Serguei Ivantsov <manowar@...-game.com>
Link: https://lore.kernel.org/regressions/CAKH+VT3YLmAn0Y8=q37UTDShqxDLsqPcQ4hBMzY7HPn7zNx+RQ@mail.gmail.com/
Cc: stable@...r.kernel.org
Signed-off-by: Christoph Böhmwalder <christoph.boehmwalder@...bit.com>
---
 drivers/block/drbd/drbd_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 79ab532aabaf..6bc86106c7b2 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1557,7 +1557,7 @@ static int _drbd_send_page(struct drbd_peer_device *peer_device, struct page *pa
 	do {
 		int sent;
 
-		bvec_set_page(&bvec, page, offset, len);
+		bvec_set_page(&bvec, page, len, offset);
 		iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, len);
 
 		sent = sock_sendmsg(socket, &msg);
-- 
2.41.0