diff options
| author | Keith Busch <kbusch@kernel.org> | 2022-07-12 17:32:54 +0200 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2022-08-03 05:08:54 +0200 |
| commit | 325347d965e7ccf5424a05398807a6d801846612 (patch) | |
| tree | 1c400bac93f02d0333993814ab6f3c3405317950 /block/bio.c | |
| parent | drivers:md:fix a potential use-after-free bug (diff) | |
| download | linux-325347d965e7ccf5424a05398807a6d801846612.tar.xz linux-325347d965e7ccf5424a05398807a6d801846612.zip | |
block: ensure iov_iter advances for added pages
There are cases where a bio may not accept additional pages, and the iov
needs to advance to the last data length that was accepted. The zone
append used to handle this correctly, but was inadvertently broken when
the setup was made common with the normal r/w case.
Fixes: 576ed9135489c ("block: use bio_add_page in bio_iov_iter_get_pages")
Fixes: c58c0074c54c2 ("block/bio: remove duplicate append pages code")
Signed-off-by: Keith Busch <kbusch@kernel.org>
Link: https://lore.kernel.org/r/20220712153256.2202024-1-kbusch@fb.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block/bio.c')
| -rw-r--r-- | block/bio.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/block/bio.c b/block/bio.c index 0d866d44ce53..d7c2536a5871 100644 --- a/block/bio.c +++ b/block/bio.c @@ -1211,6 +1211,7 @@ static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter) ssize_t size, left; unsigned len, i; size_t offset; + int ret = 0; /* * Move page array up in the allocated memory for the bio vecs as far as @@ -1235,7 +1236,6 @@ static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter) for (left = size, i = 0; left > 0; left -= len, i++) { struct page *page = pages[i]; - int ret; len = min_t(size_t, PAGE_SIZE - offset, left); if (bio_op(bio) == REQ_OP_ZONE_APPEND) @@ -1246,13 +1246,13 @@ static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter) if (ret) { bio_put_pages(pages + i, left, offset); - return ret; + break; } offset = 0; } - iov_iter_advance(iter, size); - return 0; + iov_iter_advance(iter, size - left); + return ret; } /** |