* [PATCH] block: don't overwrite bip_vcnt in bio_integrity_copy_user()
@ 2026-05-11 21:51 David Carlier
2026-05-12 6:17 ` Christoph Hellwig
2026-05-12 15:27 ` Jens Axboe
0 siblings, 2 replies; 3+ messages in thread
From: David Carlier @ 2026-05-11 21:51 UTC (permalink / raw)
To: Jens Axboe
Cc: Christoph Hellwig, Martin K . Petersen, Anuj Gupta, Kanchan Joshi,
linux-block, linux-kernel, David Carlier
bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce
segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt
on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h
read past the bip_vec[] flex array. On READ the read is in bounds
but lands on a saved user bvec instead of the bounce.
The line was added for split propagation, but bio_integrity_clone()
doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.
Fixes: 3991657ae707 ("block: set bip_vcnt correctly")
Signed-off-by: David Carlier <devnexen@gmail.com>
---
block/bio-integrity.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index e79eaf047794..869746412949 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -308,7 +308,6 @@ static int bio_integrity_copy_user(struct bio *bio, struct bio_vec *bvec,
}
bip->bip_flags |= BIP_COPY_USER;
- bip->bip_vcnt = nr_vecs;
return 0;
free_bip:
bio_integrity_free(bio);
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] block: don't overwrite bip_vcnt in bio_integrity_copy_user()
2026-05-11 21:51 [PATCH] block: don't overwrite bip_vcnt in bio_integrity_copy_user() David Carlier
@ 2026-05-12 6:17 ` Christoph Hellwig
2026-05-12 15:27 ` Jens Axboe
1 sibling, 0 replies; 3+ messages in thread
From: Christoph Hellwig @ 2026-05-12 6:17 UTC (permalink / raw)
To: David Carlier
Cc: Jens Axboe, Christoph Hellwig, Martin K . Petersen, Anuj Gupta,
Kanchan Joshi, linux-block, linux-kernel
On Mon, May 11, 2026 at 10:51:51PM +0100, David Carlier wrote:
> bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce
> segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt
> on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h
> read past the bip_vec[] flex array. On READ the read is in bounds
> but lands on a saved user bvec instead of the bounce.
>
> The line was added for split propagation, but bio_integrity_clone()
> doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.
Looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] block: don't overwrite bip_vcnt in bio_integrity_copy_user()
2026-05-11 21:51 [PATCH] block: don't overwrite bip_vcnt in bio_integrity_copy_user() David Carlier
2026-05-12 6:17 ` Christoph Hellwig
@ 2026-05-12 15:27 ` Jens Axboe
1 sibling, 0 replies; 3+ messages in thread
From: Jens Axboe @ 2026-05-12 15:27 UTC (permalink / raw)
To: David Carlier
Cc: Christoph Hellwig, Martin K . Petersen, Anuj Gupta, Kanchan Joshi,
linux-block, linux-kernel
On Mon, 11 May 2026 22:51:51 +0100, David Carlier wrote:
> bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce
> segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt
> on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h
> read past the bip_vec[] flex array. On READ the read is in bounds
> but lands on a saved user bvec instead of the bounce.
>
> The line was added for split propagation, but bio_integrity_clone()
> doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.
>
> [...]
Applied, thanks!
[1/1] block: don't overwrite bip_vcnt in bio_integrity_copy_user()
commit: 637ad3a56a3b889527d1dacea6fea2a8bd648140
Best regards,
--
Jens Axboe
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-12 15:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-11 21:51 [PATCH] block: don't overwrite bip_vcnt in bio_integrity_copy_user() David Carlier
2026-05-12 6:17 ` Christoph Hellwig
2026-05-12 15:27 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox