From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from out4-smtp.messagingengine.com ([66.111.4.28]:34833 "EHLO
        out4-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK)
        by vger.kernel.org with ESMTP id S932547AbcLLWt3 (ORCPT
        <rfc822;stable@vger.kernel.org>); Mon, 12 Dec 2016 17:49:29 -0500
Date: Mon, 12 Dec 2016 14:49:37 -0800
From: Greg KH <greg@kroah.com>
To: Jiri Slaby <jslaby@suse.cz>
Cc: stable@vger.kernel.org,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Al Viro <viro@ZenIV.linux.org.uk>
Subject: Re: [patch NOT added to 3.12 stable tree] Don't feed anything but
 regular iovec's to blk_rq_map_user_iov
Message-ID: <20161212224937.GA32167@kroah.com>
References: <20161212150727.16486-1-jslaby@suse.cz>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20161212150727.16486-1-jslaby@suse.cz>
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On Mon, Dec 12, 2016 at 04:07:27PM +0100, Jiri Slaby wrote:
> From: Linus Torvalds <torvalds@linux-foundation.org>
> 
> This patch does NOT apply to the 3.12 stable tree. If you still want
> it applied, please provide a backport.
> 
> ===============
> 
> commit a0ac402cfcdc904f9772e1762b3fda112dcc56a0 upstream.
> 
> In theory we could map other things, but there's a reason that function
> is called "user_iov".  Using anything else (like splice can do) just
> confuses it.
> 
> Reported-and-tested-by: Johannes Thumshirn <jthumshirn@suse.de>
> Cc: Al Viro <viro@ZenIV.linux.org.uk>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> ---
>  block/blk-map.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/block/blk-map.c b/block/blk-map.c
> index b8657fa8dc9a..27fd8d92892d 100644
> --- a/block/blk-map.c
> +++ b/block/blk-map.c
> @@ -118,6 +118,9 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
>  	struct iov_iter i;
>  	int ret;
>  
> +	if (!iter_is_iovec(iter))
> +		goto fail;
> +
>  	if (map_data)
>  		copy = true;
>  	else if (iov_iter_alignment(iter) & align)
> @@ -140,6 +143,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
>  
>  unmap_rq:
>  	__blk_rq_unmap_user(bio);
> +fail:
>  	rq->bio = NULL;
>  	return -EINVAL;
>  }

I had to re-write this, feel free to steal the version I wrote for
4.4.y, it's commit d41fb2fbb28d3a1085960edada6c046becd1fafd in the
linux-stable tree.

thanks,

greg k-h