[PATCH 6.12 634/666] netfs: fix error handling in netfs_extract_user_iter()

[PATCH 6.12 634/666] netfs: fix error handling in netfs_extract_user_iter()

[Greg Kroah-Hartman]

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paulo Alcantara <pc@manguebit.org>

commit 0aad5704c6b4d14007d4eab15883e8524e4310f4 upstream.

In netfs_extract_user_iter(), if iov_iter_extract_pages() failed to
extract user pages, bail out on -ENOMEM, otherwise return the error
code only if @npages == 0, allowing short DIO reads and writes to be
issued.

This fixes mmapstress02 from LTP tests against CIFS.

Fixes: 85dd2c8ff368 ("netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator")
Reported-by: Xiaoli Feng <xifeng@redhat.com>
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260512123404.719402-10-dhowells@redhat.com
Cc: netfs@lists.linux.dev
Cc: stable@vger.kernel.org
Cc: linux-cifs@vger.kernel.org
Cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/netfs/iterator.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

--- a/fs/netfs/iterator.c
+++ b/fs/netfs/iterator.c
@@ -22,7 +22,7 @@
  *
  * Extract the page fragments from the given amount of the source iterator and
  * build up a second iterator that refers to all of those bits.  This allows
- * the original iterator to disposed of.
+ * the original iterator to be disposed of.
  *
  * @extraction_flags can have ITER_ALLOW_P2PDMA set to request peer-to-peer DMA be
  * allowed on the pages extracted.
@@ -67,8 +67,8 @@ ssize_t netfs_extract_user_iter(struct i
 		ret = iov_iter_extract_pages(orig, &pages, count,
 					     max_pages - npages, extraction_flags,
 					     &offset);
-		if (ret < 0) {
-			pr_err("Couldn't get user pages (rc=%zd)\n", ret);
+		if (unlikely(ret <= 0)) {
+			ret = ret ?: -EIO;
 			break;
 		}
 
@@ -97,6 +97,13 @@ ssize_t netfs_extract_user_iter(struct i
 		npages += cur_npages;
 	}
 
+	if (ret < 0 && (ret == -ENOMEM || npages == 0)) {
+		for (i = 0; i < npages; i++)
+			unpin_user_page(bv[i].bv_page);
+		kvfree(bv);
+		return ret;
+	}
+
 	iov_iter_bvec(new, orig->data_source, bv, npages, orig_len - count);
 	return npages;
 }

Re: [PATCH 6.12 634/666] netfs: fix error handling in netfs_extract_user_iter()

[Harshit Mogalapalli]

Hi Greg/Sasha,

On 20/05/26 21:54, Greg Kroah-Hartman wrote:
> 6.12-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Paulo Alcantara <pc@manguebit.org>
> 
> commit 0aad5704c6b4d14007d4eab15883e8524e4310f4 upstream.
> 
> In netfs_extract_user_iter(), if iov_iter_extract_pages() failed to
> extract user pages, bail out on -ENOMEM, otherwise return the error
> code only if @npages == 0, allowing short DIO reads and writes to be
> issued.
> 
> This fixes mmapstress02 from LTP tests against CIFS.
> 
> Fixes: 85dd2c8ff368 ("netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator")
> Reported-by: Xiaoli Feng <xifeng@redhat.com>
> Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
> Signed-off-by: David Howells <dhowells@redhat.com>
> Link: https://patch.msgid.link/20260512123404.719402-10-dhowells@redhat.com
> Cc: netfs@lists.linux.dev
> Cc: stable@vger.kernel.org
> Cc: linux-cifs@vger.kernel.org
> Cc: linux-fsdevel@vger.kernel.org
> Signed-off-by: Christian Brauner <brauner@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>   fs/netfs/iterator.c |   13 ++++++++++---
>   1 file changed, 10 insertions(+), 3 deletions(-)
> 
> --- a/fs/netfs/iterator.c
> +++ b/fs/netfs/iterator.c
> @@ -22,7 +22,7 @@
>    *
>    * Extract the page fragments from the given amount of the source iterator and
>    * build up a second iterator that refers to all of those bits.  This allows
> - * the original iterator to disposed of.
> + * the original iterator to be disposed of.
>    *
>    * @extraction_flags can have ITER_ALLOW_P2PDMA set to request peer-to-peer DMA be
>    * allowed on the pages extracted.
> @@ -67,8 +67,8 @@ ssize_t netfs_extract_user_iter(struct i
>   		ret = iov_iter_extract_pages(orig, &pages, count,
>   					     max_pages - npages, extraction_flags,
>   					     &offset);
> -		if (ret < 0) {
> -			pr_err("Couldn't get user pages (rc=%zd)\n", ret);
> +		if (unlikely(ret <= 0)) {
> +			ret = ret ?: -EIO;
>   			break;
>   		}
>   
> @@ -97,6 +97,13 @@ ssize_t netfs_extract_user_iter(struct i
>   		npages += cur_npages;
>   	}
>   
> +	if (ret < 0 && (ret == -ENOMEM || npages == 0)) {
> +		for (i = 0; i < npages; i++)
> +			unpin_user_page(bv[i].bv_page);
> +		kvfree(bv);
> +		return ret;
> +	}
> +

I have run an AI assisted backport review and it spotted an issue: I
have taken a look and the issues goes like:

Upstream has:



ssize_t ret = 0;

...
if (ret < 0 && (ret == -ENOMEM || npages == 0)) {
         for (i = 0; i < npages; i++)
                 unpin_user_page(bv[i].bv_page);
         kvfree(bv);
         return ret;
}

6.12.y has:

ssize_t ret;

...
if (ret < 0 && (ret == -ENOMEM || npages == 0)) {
         for (i = 0; i < npages; i++)
                 unpin_user_page(bv[i].bv_page);
         kvfree(bv);
         return ret;
}

I think 6.12.y misses commit: 7e3d8db899d5 ("netfs: Fix potential 
uninitialised var in netfs_extract_user_iter()") so backport might not 
be complete, thoughts ?

thanks,
Harshit


>   	iov_iter_bvec(new, orig->data_source, bv, npages, orig_len - count);
>   	return npages;
>   }
> 
> 
> 

Re: [PATCH 6.12 634/666] netfs: fix error handling in netfs_extract_user_iter()

[Greg Kroah-Hartman]

On Sat, May 23, 2026 at 01:53:15AM +0530, Harshit Mogalapalli wrote:
> Hi Greg/Sasha,
> 
> On 20/05/26 21:54, Greg Kroah-Hartman wrote:
> > 6.12-stable review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > From: Paulo Alcantara <pc@manguebit.org>
> > 
> > commit 0aad5704c6b4d14007d4eab15883e8524e4310f4 upstream.
> > 
> > In netfs_extract_user_iter(), if iov_iter_extract_pages() failed to
> > extract user pages, bail out on -ENOMEM, otherwise return the error
> > code only if @npages == 0, allowing short DIO reads and writes to be
> > issued.
> > 
> > This fixes mmapstress02 from LTP tests against CIFS.
> > 
> > Fixes: 85dd2c8ff368 ("netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator")
> > Reported-by: Xiaoli Feng <xifeng@redhat.com>
> > Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
> > Signed-off-by: David Howells <dhowells@redhat.com>
> > Link: https://patch.msgid.link/20260512123404.719402-10-dhowells@redhat.com
> > Cc: netfs@lists.linux.dev
> > Cc: stable@vger.kernel.org
> > Cc: linux-cifs@vger.kernel.org
> > Cc: linux-fsdevel@vger.kernel.org
> > Signed-off-by: Christian Brauner <brauner@kernel.org>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> >   fs/netfs/iterator.c |   13 ++++++++++---
> >   1 file changed, 10 insertions(+), 3 deletions(-)
> > 
> > --- a/fs/netfs/iterator.c
> > +++ b/fs/netfs/iterator.c
> > @@ -22,7 +22,7 @@
> >    *
> >    * Extract the page fragments from the given amount of the source iterator and
> >    * build up a second iterator that refers to all of those bits.  This allows
> > - * the original iterator to disposed of.
> > + * the original iterator to be disposed of.
> >    *
> >    * @extraction_flags can have ITER_ALLOW_P2PDMA set to request peer-to-peer DMA be
> >    * allowed on the pages extracted.
> > @@ -67,8 +67,8 @@ ssize_t netfs_extract_user_iter(struct i
> >   		ret = iov_iter_extract_pages(orig, &pages, count,
> >   					     max_pages - npages, extraction_flags,
> >   					     &offset);
> > -		if (ret < 0) {
> > -			pr_err("Couldn't get user pages (rc=%zd)\n", ret);
> > +		if (unlikely(ret <= 0)) {
> > +			ret = ret ?: -EIO;
> >   			break;
> >   		}
> > @@ -97,6 +97,13 @@ ssize_t netfs_extract_user_iter(struct i
> >   		npages += cur_npages;
> >   	}
> > +	if (ret < 0 && (ret == -ENOMEM || npages == 0)) {
> > +		for (i = 0; i < npages; i++)
> > +			unpin_user_page(bv[i].bv_page);
> > +		kvfree(bv);
> > +		return ret;
> > +	}
> > +
> 
> I have run an AI assisted backport review and it spotted an issue: I
> have taken a look and the issues goes like:
> 
> Upstream has:
> 
> 
> 
> ssize_t ret = 0;
> 
> ...
> if (ret < 0 && (ret == -ENOMEM || npages == 0)) {
>         for (i = 0; i < npages; i++)
>                 unpin_user_page(bv[i].bv_page);
>         kvfree(bv);
>         return ret;
> }
> 
> 6.12.y has:
> 
> ssize_t ret;
> 
> ...
> if (ret < 0 && (ret == -ENOMEM || npages == 0)) {
>         for (i = 0; i < npages; i++)
>                 unpin_user_page(bv[i].bv_page);
>         kvfree(bv);
>         return ret;
> }
> 
> I think 6.12.y misses commit: 7e3d8db899d5 ("netfs: Fix potential
> uninitialised var in netfs_extract_user_iter()") so backport might not be
> complete, thoughts ?

Now applied, thanks.

greg k-h