diff options
| author | David Carlier <devnexen@gmail.com> | 2026-05-11 22:51:51 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-05-12 09:23:31 -0600 |
| commit | 637ad3a56a3b889527d1dacea6fea2a8bd648140 (patch) | |
| tree | ac3d11b7113ab5b50d6ebcfd932e4f6a0038d947 /block/bio-integrity.c | |
| parent | 1860c2f85922917d8a46f16a6f4bd2298ffa0fb5 (diff) | |
block: don't overwrite bip_vcnt in bio_integrity_copy_user()
bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce
segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt
on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h
read past the bip_vec[] flex array. On READ the read is in bounds
but lands on a saved user bvec instead of the bounce.
The line was added for split propagation, but bio_integrity_clone()
doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.
Fixes: 3991657ae707 ("block: set bip_vcnt correctly")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511215151.346228-1-devnexen@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block/bio-integrity.c')
| -rw-r--r-- | block/bio-integrity.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/block/bio-integrity.c b/block/bio-integrity.c index e54c6e06e1cb..78e678d4104b 100644 --- a/block/bio-integrity.c +++ b/block/bio-integrity.c @@ -308,7 +308,6 @@ static int bio_integrity_copy_user(struct bio *bio, struct bio_vec *bvec, } bip->bip_flags |= BIP_COPY_USER; - bip->bip_vcnt = nr_vecs; return 0; free_bip: bio_integrity_free(bio); |