linux-kernel - Re: [PATCH 1/2] iov_iter: iterate_folioq: fix handling of offset >= folio size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250813051633.GA3895812@ax162>
Date: Tue, 12 Aug 2025 22:16:33 -0700
From: Nathan Chancellor <nathan@...nel.org>
To: kernel test robot <lkp@...el.com>
Cc: Dominique Martinet via B4 Relay <devnull+asmadeus.codewreck.org@...nel.org>,
	"Matthew Wilcox (Oracle)" <willy@...radead.org>,
	Christian Brauner <brauner@...nel.org>,
	David Howells <dhowells@...hat.com>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Andrew Morton <akpm@...ux-foundation.org>, llvm@...ts.linux.dev,
	oe-kbuild-all@...ts.linux.dev,
	Linux Memory Management List <linux-mm@...ck.org>,
	Maximilian Bosch <maximilian@...sch.me>,
	Ryan Lahfa <ryan@...fa.xyz>, Christian Theune <ct@...ingcircus.io>,
	Arnout Engelen <arnout@...t.net>, linux-kernel@...r.kernel.org,
	linux-block@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	Dominique Martinet <asmadeus@...ewreck.org>, stable@...r.kernel.org
Subject: Re: [PATCH 1/2] iov_iter: iterate_folioq: fix handling of offset >=
 folio size

On Tue, Aug 12, 2025 at 02:55:55AM +0800, kernel test robot wrote:
> Hi Dominique,
> 
> kernel test robot noticed the following build warnings:
> 
> [auto build test WARNING on 8f5ae30d69d7543eee0d70083daf4de8fe15d585]
> 
> url:    https://github.com/intel-lab-lkp/linux/commits/Dominique-Martinet-via-B4-Relay/iov_iter-iterate_folioq-fix-handling-of-offset-folio-size/20250811-154319
> base:   8f5ae30d69d7543eee0d70083daf4de8fe15d585
> patch link:    https://lore.kernel.org/r/20250811-iot_iter_folio-v1-1-d9c223adf93c%40codewreck.org
> patch subject: [PATCH 1/2] iov_iter: iterate_folioq: fix handling of offset >= folio size
> config: i386-buildonly-randconfig-002-20250811 (https://download.01.org/0day-ci/archive/20250812/202508120250.Eooq2ydr-lkp@intel.com/config)
> compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250812/202508120250.Eooq2ydr-lkp@intel.com/reproduce)
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@...el.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202508120250.Eooq2ydr-lkp@intel.com/
> 
> All warnings (new ones prefixed by >>):
> 
>    In file included from lib/iov_iter.c:14:
> >> include/linux/iov_iter.h:171:7: warning: variable 'remain' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
>      171 |                 if (skip >= fsize)
>          |                     ^~~~~~~~~~~~~
>    include/linux/iov_iter.h:190:7: note: uninitialized use occurs here
>      190 |                 if (remain)
>          |                     ^~~~~~
>    include/linux/iov_iter.h:171:3: note: remove the 'if' if its condition is always false
>      171 |                 if (skip >= fsize)
>          |                 ^~~~~~~~~~~~~~~~~~
>      172 |                         goto next;
>          |                         ~~~~~~~~~
>    include/linux/iov_iter.h:163:22: note: initialize the variable 'remain' to silence this warning
>      163 |                 size_t part, remain, consumed;
>          |                                    ^
>          |                                     = 0
>    1 warning generated.

I see this in -next now, should remain be zero initialized or is there
some other fix that is needed?

> vim +171 include/linux/iov_iter.h
> 
>    143	
>    144	/*
>    145	 * Handle ITER_FOLIOQ.
>    146	 */
>    147	static __always_inline
>    148	size_t iterate_folioq(struct iov_iter *iter, size_t len, void *priv, void *priv2,
>    149			      iov_step_f step)
>    150	{
>    151		const struct folio_queue *folioq = iter->folioq;
>    152		unsigned int slot = iter->folioq_slot;
>    153		size_t progress = 0, skip = iter->iov_offset;
>    154	
>    155		if (slot == folioq_nr_slots(folioq)) {
>    156			/* The iterator may have been extended. */
>    157			folioq = folioq->next;
>    158			slot = 0;
>    159		}
>    160	
>    161		do {
>    162			struct folio *folio = folioq_folio(folioq, slot);
>    163			size_t part, remain, consumed;
>    164			size_t fsize;
>    165			void *base;
>    166	
>    167			if (!folio)
>    168				break;
>    169	
>    170			fsize = folioq_folio_size(folioq, slot);
>  > 171			if (skip >= fsize)
>    172				goto next;
>    173			base = kmap_local_folio(folio, skip);
>    174			part = umin(len, PAGE_SIZE - skip % PAGE_SIZE);
>    175			remain = step(base, progress, part, priv, priv2);
>    176			kunmap_local(base);
>    177			consumed = part - remain;
>    178			len -= consumed;
>    179			progress += consumed;
>    180			skip += consumed;
>    181			if (skip >= fsize) {
>    182	next:
>    183				skip = 0;
>    184				slot++;
>    185				if (slot == folioq_nr_slots(folioq) && folioq->next) {
>    186					folioq = folioq->next;
>    187					slot = 0;
>    188				}
>    189			}
>    190			if (remain)
>    191				break;
>    192		} while (len);
>    193	
>    194		iter->folioq_slot = slot;
>    195		iter->folioq = folioq;
>    196		iter->iov_offset = skip;
>    197		iter->count -= progress;
>    198		return progress;
>    199	}
>    200	
> 
> -- 
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki