linux-kernel - [PATCH 1/2] iov_iter: iterate_folioq: fix handling of offset >= folio size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250811-iot_iter_folio-v1-1-d9c223adf93c@codewreck.org>
Date: Mon, 11 Aug 2025 16:39:05 +0900
From: Dominique Martinet via B4 Relay <devnull+asmadeus.codewreck.org@...nel.org>
To: "Matthew Wilcox (Oracle)" <willy@...radead.org>, 
 Christian Brauner <brauner@...nel.org>, David Howells <dhowells@...hat.com>, 
 Alexander Viro <viro@...iv.linux.org.uk>, 
 Andrew Morton <akpm@...ux-foundation.org>
Cc: Maximilian Bosch <maximilian@...sch.me>, Ryan Lahfa <ryan@...fa.xyz>, 
 Christian Theune <ct@...ingcircus.io>, Arnout Engelen <arnout@...t.net>, 
 linux-kernel@...r.kernel.org, linux-block@...r.kernel.org, 
 linux-fsdevel@...r.kernel.org, Dominique Martinet <asmadeus@...ewreck.org>, 
 stable@...r.kernel.org
Subject: [PATCH 1/2] iov_iter: iterate_folioq: fix handling of offset >=
 folio size

From: Dominique Martinet <asmadeus@...ewreck.org>

It's apparently possible to get an iov forwarded all the way up to the
end of the current page we're looking at, e.g.

(gdb) p *iter
$24 = {iter_type = 4 '\004', nofault = false, data_source = false, iov_offset = 4096, {__ubuf_iovec = {
      iov_base = 0xffff88800f5bc000, iov_len = 655}, {{__iov = 0xffff88800f5bc000, kvec = 0xffff88800f5bc000,
        bvec = 0xffff88800f5bc000, folioq = 0xffff88800f5bc000, xarray = 0xffff88800f5bc000,
        ubuf = 0xffff88800f5bc000}, count = 655}}, {nr_segs = 2, folioq_slot = 2 '\002', xarray_start = 2}}

Where iov_offset is 4k with 4k-sized folios

This should have been because we're only in the 2nd slot and there's
another one after this, but iterate_folioq should not try to map a
folio that skips the whole size, and more importantly part here does
not end up zero (because 'PAGE_SIZE - skip % PAGE_SIZE' ends up
PAGE_SIZE and not zero..), so skip forward to the "advance to next
folio" code.

Reported-by: Maximilian Bosch <maximilian@...sch.me>
Reported-by: Ryan Lahfa <ryan@...fa.xyz>
Reported-by: Christian Theune <ct@...ingcircus.io>
Reported-by: Arnout Engelen <arnout@...t.net>
Link: https://lkml.kernel.org/r/D4LHHUNLG79Y.12PI0X6BEHRHW@mbosch.me/
Fixes: db0aa2e9566f ("mm: Define struct folio_queue and ITER_FOLIOQ to handle a sequence of folios")
Cc: stable@...r.kernel.org # v6.12+
Signed-off-by: Dominique Martinet <asmadeus@...ewreck.org>
---
 include/linux/iov_iter.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/linux/iov_iter.h b/include/linux/iov_iter.h
index c4aa58032faf874ee5b29bd37f9e23c479741bef..7988a0fc94ad0525b475196035dc5d754fd3d117 100644
--- a/include/linux/iov_iter.h
+++ b/include/linux/iov_iter.h
@@ -168,6 +168,8 @@ size_t iterate_folioq(struct iov_iter *iter, size_t len, void *priv, void *priv2
 			break;
 
 		fsize = folioq_folio_size(folioq, slot);
+		if (skip >= fsize)
+			goto next;
 		base = kmap_local_folio(folio, skip);
 		part = umin(len, PAGE_SIZE - skip % PAGE_SIZE);
 		remain = step(base, progress, part, priv, priv2);
@@ -177,6 +179,7 @@ size_t iterate_folioq(struct iov_iter *iter, size_t len, void *priv, void *priv2
 		progress += consumed;
 		skip += consumed;
 		if (skip >= fsize) {
+next:
 			skip = 0;
 			slot++;
 			if (slot == folioq_nr_slots(folioq) && folioq->next) {

-- 
2.50.1