Skip to contentSkip to conversation

block: don't overwrite bip_vcnt in bio_integrity_copy_user()

PATCH Applied David Carlier 3 participants 3 messages May 11 – May 12 Block layer

lore
Share & tools
lore

David Carlier

author
#0 lore raw

PATCH 1/1 block: don't overwrite bip_vcnt in bio_integrity_copy_user()

bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h read past the bip_vec[] flex array. On READ the read is in bounds but lands on a saved user bvec instead of the bounce.

The line was added for split propagation, but bio_integrity_clone() doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.

Fixes 3991657ae707 ("block: set bip_vcnt correctly")
Signed-off-by David Carlier <[email protected]>
---
 block/bio-integrity.c | 1 -
 1 file changed, 1 deletion(-)
block/bio-integrity.c +0 -1
index e79eaf047794..869746412949 100644
@@ -308,7 +308,6 @@ static int bio_integrity_copy_user(struct bio *bio, struct bio_vec *bvec,
 	}
 
 	bip->bip_flags |= BIP_COPY_USER;
-	bip->bip_vcnt = nr_vecs;
 	return 0;
 free_bip:
 	bio_integrity_free(bio);
Signature · 1 line
2.53.0
Reviewed-by on v1 1/1
#1 lore raw
Quoted 8 lines · David Carlier

bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h read past the bip_vec[] flex array. On READ the read is in bounds but lands on a saved user bvec instead of the bounce.

The line was added for split propagation, but bio_integrity_clone() doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.

Looks good:

Reviewed-by Christoph Hellwig <[email protected]>
maintainer Applied
#2 lore raw
In reply to David Carlier
Quoted 10 lines · David Carlier

bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h read past the bip_vec[] flex array. On READ the read is in bounds but lands on a saved user bvec instead of the bounce.

The line was added for split propagation, but bio_integrity_clone() doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.

[...]

Applied, thanks!

[1/1] block: don't overwrite bip_vcnt in bio_integrity_copy_user()

      commit: 637ad3a56a3b889527d1dacea6fea2a8bd648140

Best regards,

Signature · 1 line
Jens Axboe