linux-kernel - [PATCH 2/2] iov_iter: iov_folioq_get_pages: don't leave empty slot behind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250811-iot_iter_folio-v1-2-d9c223adf93c@codewreck.org>
Date: Mon, 11 Aug 2025 16:39:06 +0900
From: Dominique Martinet via B4 Relay <devnull+asmadeus.codewreck.org@...nel.org>
To: "Matthew Wilcox (Oracle)" <willy@...radead.org>, 
 Christian Brauner <brauner@...nel.org>, David Howells <dhowells@...hat.com>, 
 Alexander Viro <viro@...iv.linux.org.uk>, 
 Andrew Morton <akpm@...ux-foundation.org>
Cc: Maximilian Bosch <maximilian@...sch.me>, Ryan Lahfa <ryan@...fa.xyz>, 
 Christian Theune <ct@...ingcircus.io>, Arnout Engelen <arnout@...t.net>, 
 linux-kernel@...r.kernel.org, linux-block@...r.kernel.org, 
 linux-fsdevel@...r.kernel.org, Dominique Martinet <asmadeus@...ewreck.org>
Subject: [PATCH 2/2] iov_iter: iov_folioq_get_pages: don't leave empty slot
 behind

From: Dominique Martinet <asmadeus@...ewreck.org>

After advancing into a folioq it makes more sense to point to the next
slot than at the end of the current slot.
This should not be needed for correctness, but this also happens to
"fix" the 9p bug with iterate_folioq() not copying properly.

Signed-off-by: Dominique Martinet <asmadeus@...ewreck.org>
---
 lib/iov_iter.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index f9193f952f49945297479483755d68a34c6d4ffe..65c05134ab934e1e0bf5d010fff22983bfe9c680 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1032,9 +1032,6 @@ static ssize_t iter_folioq_get_pages(struct iov_iter *iter,
 			maxpages--;
 		}
 
-		if (maxpages == 0 || extracted >= maxsize)
-			break;
-
 		if (iov_offset >= fsize) {
 			iov_offset = 0;
 			slot++;
@@ -1043,6 +1040,9 @@ static ssize_t iter_folioq_get_pages(struct iov_iter *iter,
 				slot = 0;
 			}
 		}
+
+		if (maxpages == 0 || extracted >= maxsize)
+			break;
 	}
 
 	iter->count = count;

-- 
2.50.1