diff options
| author | David Carlier <devnexen@gmail.com> | 2026-05-11 22:51:51 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-05-12 09:23:31 -0600 |
| commit | 637ad3a56a3b889527d1dacea6fea2a8bd648140 (patch) | |
| tree | ac3d11b7113ab5b50d6ebcfd932e4f6a0038d947 /tools/lib/python/kdoc | |
| parent | 1860c2f85922917d8a46f16a6f4bd2298ffa0fb5 (diff) | |
| download | linux-637ad3a56a3b889527d1dacea6fea2a8bd648140.tar.gz linux-637ad3a56a3b889527d1dacea6fea2a8bd648140.zip | |
block: don't overwrite bip_vcnt in bio_integrity_copy_user()
bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce
segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt
on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h
read past the bip_vec[] flex array. On READ the read is in bounds
but lands on a saved user bvec instead of the bounce.
The line was added for split propagation, but bio_integrity_clone()
doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.
Fixes: 3991657ae707 ("block: set bip_vcnt correctly")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511215151.346228-1-devnexen@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'tools/lib/python/kdoc')
0 files changed, 0 insertions, 0 deletions