linux-kernel - Re: 9p read corruption of mmaped content (Was: [PATCH] 9p/virtio: restrict page pinning to user_backed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <818489.1766152917@warthog.procyon.org.uk>
Date: Fri, 19 Dec 2025 14:01:57 +0000
From: David Howells <dhowells@...hat.com>
To: Dominique Martinet <asmadeus@...ewreck.org>
Cc: dhowells@...hat.com, Christian Schoenebeck <linux_oss@...debyte.com>,
    Eric Van Hensbergen <ericvh@...nel.org>,
    Latchesar Ionkov <lucho@...kov.net>,
    Chris Arges <carges@...udflare.com>, v9fs@...ts.linux.dev,
    linux-kernel@...r.kernel.org, Matthew Wilcox <willy@...radead.org>,
    linux-fsdevel@...r.kernel.org
Subject: Re: 9p read corruption of mmaped content (Was: [PATCH] 9p/virtio: restrict page pinning to user_backed_iter() iovec)

Dominique Martinet <asmadeus@...ewreck.org> wrote:

>    netfs_collect_folio: R=00001b55 ix=00003 r=3000-4000 t=3000/5fb2
>    netfs_folio: i=157f3 ix=00003-00003 read-done
>    netfs_folio: i=157f3 ix=00003-00003 read-unlock
>    netfs_collect_folio: R=00001b55 ix=00004 r=4000-5000 t=4000/5fb2
>    netfs_folio: i=157f3 ix=00004-00004 read-done
>    netfs_folio: i=157f3 ix=00004-00004 read-unlock
>    netfs_collect_folio: R=00001b55 ix=00005 r=5000-5fb2 t=5000/5fb2
>    netfs_folio: i=157f3 ix=00005-00005 read-done
>    netfs_folio: i=157f3 ix=00005-00005 read-unlock
>    ...
>    netfs_collect_stream: R=00001b55[0:] cto=5fb2 frn=ffffffff
>    netfs_collect_state: R=00001b55 col=5fb2 cln=6000 n=c
>    netfs_collect_stream: R=00001b55[0:] cto=5fb2 frn=ffffffff
>    netfs_collect_state: R=00001b55 col=5fb2 cln=6000 n=8
>    ...
>    netfs_sreq: R=00001b55[2] ZERO SUBMT f=000 s=5fb2 0/4e s=0 e=0
>    netfs_sreq: R=00001b55[2] ZERO TERM  f=102 s=5fb2 4e/4e s=5 e=0

This would seem to show a problem, if not the problem.

We unlocked page ix=00005 before doing the ZERO subreq that clears the page
tail.  That shouldn't have happened since the collection point hasn't reached
the end of the folio yet.

David