Re: [PATCH] iov_iter: fix advancing slot in iter_folioq_get_pages()

[Leon Romanovsky <leon@kernel.org>]

On Mon, Sep 30, 2024 at 09:10:02PM +0100, David Howells wrote:
> Omar Sandoval <osandov@osandov.com> wrote:
> 
> > From: Omar Sandoval <osandov@fb.com>
> > 
> > iter_folioq_get_pages() decides to advance to the next folioq slot when
> > it has reached the end of the current folio. However, it is checking
> > offset, which is the beginning of the current part, instead of
> > iov_offset, which is adjusted to the end of the current part, so it
> > doesn't advance the slot when it's supposed to. As a result, on the next
> > iteration, we'll use the same folio with an out-of-bounds offset and
> > return an unrelated page.
> > 
> > This manifested as various crashes and other failures in 9pfs in drgn's
> > VM testing setup and BPF CI.
> > 
> > Fixes: db0aa2e9566f ("mm: Define struct folio_queue and ITER_FOLIOQ to handle a sequence of folios")
> > Link: https://lore.kernel.org/linux-fsdevel/20240923183432.1876750-1-chantr4@gmail.com/
> > Tested-by: Manu Bretelle <chantr4@gmail.com>
> > Signed-off-by: Omar Sandoval <osandov@fb.com>
> 
> Thanks for finding that!  That would explain why I didn't see it with afs or
> cifs - both of those pass the iterator directly to the socket rather than
> pulling the pages out of it.  I'm not sure how I managed to do things like run
> xfstests to completion and git clone and build a kernel without encountering
> the bug.
> 
> Christian: Can you add this to vfs.fixes and tag it:
> 
> Acked-by: David Howells <dhowells@redhat.com>
> Tested-by: Eduard Zingerman <eddyz87@gmail.com>

It worked for me too.

Tested-by: Leon Romanovsky <leon@kernel.org>

Thanks