linux-kernel - [PATCH 0/2] iterate_folioq bug when offset==size (Was: [REGRESSION] 9pfs issues on 6.12-rc1)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250811-iot_iter_folio-v1-0-d9c223adf93c@codewreck.org>
Date: Mon, 11 Aug 2025 16:39:04 +0900
From: Dominique Martinet via B4 Relay <devnull+asmadeus.codewreck.org@...nel.org>
To: "Matthew Wilcox (Oracle)" <willy@...radead.org>, 
 Christian Brauner <brauner@...nel.org>, David Howells <dhowells@...hat.com>, 
 Alexander Viro <viro@...iv.linux.org.uk>, 
 Andrew Morton <akpm@...ux-foundation.org>
Cc: Maximilian Bosch <maximilian@...sch.me>, Ryan Lahfa <ryan@...fa.xyz>, 
 Christian Theune <ct@...ingcircus.io>, Arnout Engelen <arnout@...t.net>, 
 linux-kernel@...r.kernel.org, linux-block@...r.kernel.org, 
 linux-fsdevel@...r.kernel.org, Dominique Martinet <asmadeus@...ewreck.org>, 
 stable@...r.kernel.org
Subject: [PATCH 0/2] iterate_folioq bug when offset==size (Was:
 [REGRESSION] 9pfs issues on 6.12-rc1)

So we've had this regression in 9p for.. almost a year, which is way too
long, but there was no "easy" reproducer until yesterday (thank you
again!!)

It turned out to be a bug with iov_iter on folios,
iov_iter_get_pages_alloc2() would advance the iov_iter correctly up to
the end edge of a folio and the later copy_to_iter() fails on the
iterate_folioq() bug.

Happy to consider alternative ways of fixing this, now there's a
reproducer it's all much clearer; for the bug to be visible we basically
need to make and IO with non-contiguous folios in the iov_iter which is
not obvious to test with synthetic VMs, with size that triggers a
zero-copy read followed by a non-zero-copy read.

Signed-off-by: Dominique Martinet <asmadeus@...ewreck.org>
---
Dominique Martinet (2):
      iov_iter: iterate_folioq: fix handling of offset >= folio size
      iov_iter: iov_folioq_get_pages: don't leave empty slot behind

 include/linux/iov_iter.h | 3 +++
 lib/iov_iter.c           | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)
---
base-commit: 8f5ae30d69d7543eee0d70083daf4de8fe15d585
change-id: 20250811-iot_iter_folio-1b7849f88fed

Best regards,
-- 
Dominique Martinet <asmadeus@...ewreck.org>