Re: [PATCH] filemap: Fix bounds checking in filemap_read()

[Matthew Wilcox <willy@infradead.org>]

On Fri, Sep 13, 2024 at 01:57:04PM -0400, trondmy@kernel.org wrote:
> If the caller supplies an iocb->ki_pos value that is close to the
> filesystem upper limit, and an iterator with a count that causes us to
> overflow that limit, then filemap_read() enters an infinite loop.

Are we guaranteed that ki_pos lies in the range [0..s_maxbytes)?
I'm not too familiar with the upper paths of the VFS and what guarantees
we can depend on.  If we are guaranteed that, could somebody document
it (and indeed create kernel-doc for struct kiocb)?

>  
> -	iov_iter_truncate(iter, inode->i_sb->s_maxbytes);
> +	iov_iter_truncate(iter, inode->i_sb->s_maxbytes - iocb->ki_pos);
>  	folio_batch_init(&fbatch);
>  
>  	do {
> -- 
> 2.46.0
>