Re: [PATCH] iomap: adjust read range correctly for non-block-aligned positions

[Brian Foster <bfoster@redhat.com>]

On Mon, Sep 22, 2025 at 11:00:42AM -0700, Joanne Koong wrote:
> iomap_adjust_read_range() assumes that the position and length passed in
> are block-aligned. This is not always the case however, as shown in the
> syzbot generated case for erofs. This causes too many bytes to be
> skipped for uptodate blocks, which results in returning the incorrect
> position and length to read in. If all the blocks are uptodate, this
> underflows length and returns a position beyond the folio.
> 
> Fix the calculation to also take into account the block offset when
> calculating how many bytes can be skipped for uptodate blocks.
> 
> Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
> Tested-by: syzbot@syzkaller.appspotmail.com
> ---

Reviewed-by: Brian Foster <bfoster@redhat.com>

>  fs/iomap/buffered-io.c | 19 +++++++++++++------
>  1 file changed, 13 insertions(+), 6 deletions(-)
> 
> diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
> index 8b847a1e27f1..1c95a0a7b302 100644
> --- a/fs/iomap/buffered-io.c
> +++ b/fs/iomap/buffered-io.c
> @@ -240,17 +240,24 @@ static void iomap_adjust_read_range(struct inode *inode, struct folio *folio,
>  	 * to avoid reading in already uptodate ranges.
>  	 */
>  	if (ifs) {
> -		unsigned int i;
> +		unsigned int i, blocks_skipped;
>  
>  		/* move forward for each leading block marked uptodate */
> -		for (i = first; i <= last; i++) {
> +		for (i = first; i <= last; i++)
>  			if (!ifs_block_is_uptodate(ifs, i))
>  				break;
> -			*pos += block_size;
> -			poff += block_size;
> -			plen -= block_size;
> -			first++;
> +
> +		blocks_skipped = i - first;
> +		if (blocks_skipped) {
> +			unsigned long block_offset = *pos & (block_size - 1);
> +			unsigned bytes_skipped =
> +				(blocks_skipped << block_bits) - block_offset;
> +
> +			*pos += bytes_skipped;
> +			poff += bytes_skipped;
> +			plen -= bytes_skipped;
>  		}
> +		first = i;
>  
>  		/* truncate len if we find any trailing uptodate block(s) */
>  		while (++i <= last) {
> -- 
> 2.47.3
>