+++ /dev/null
-From 2ff949441802a8d076d9013c7761f63e8ae5a9bd Mon Sep 17 00:00:00 2001
-From: Xinyu Zhang <xizhang@purestorage.com>
-Date: Wed, 23 Oct 2024 15:15:19 -0600
-Subject: block: fix sanity checks in blk_rq_map_user_bvec
-
-From: Xinyu Zhang <xizhang@purestorage.com>
-
-commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd upstream.
-
-blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which
-causes unnecessary failures in NVMe passthrough I/O, reproducible as
-follows:
-
-- register a 2 page, page-aligned buffer against a ring
-- use that buffer to do a 1 page io_uring NVMe passthrough read
-
-The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will
-then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so
-the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to
-fail. This failure is unnecessary, as when the check succeeds, it means
-we've checked the entire buffer that will be used by the request - i.e.
-blk_rq_map_user_bvec should complete successfully. Therefore, terminate
-the loop early and return successfully when the check bytes + bv->bv_len
-> nr_iter succeeds.
-
-While we're at it, also remove the check that all segments in the bvec
-are single-page. While this seems to be true for all users of the
-function, it doesn't appear to be required anywhere downstream.
-
-CC: stable@vger.kernel.org
-Signed-off-by: Xinyu Zhang <xizhang@purestorage.com>
-Co-developed-by: Uday Shankar <ushankar@purestorage.com>
-Signed-off-by: Uday Shankar <ushankar@purestorage.com>
-Fixes: 37987547932c ("block: extend functionality to map bvec iterator")
-Link: https://lore.kernel.org/r/20241023211519.4177873-1-ushankar@purestorage.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- block/blk-map.c | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
---- a/block/blk-map.c
-+++ b/block/blk-map.c
-@@ -597,9 +597,7 @@ static int blk_rq_map_user_bvec(struct r
- if (nsegs >= nr_segs || bytes > UINT_MAX - bv->bv_len)
- goto put_bio;
- if (bytes + bv->bv_len > nr_iter)
-- goto put_bio;
-- if (bv->bv_offset + bv->bv_len > PAGE_SIZE)
-- goto put_bio;
-+ break;
-
- nsegs++;
- bytes += bv->bv_len;
selinux-improve-error-checking-in-sel_write_load.patch
serial-protect-uart_port_dtr_rts-in-uart_shutdown-to.patch
net-phy-dp83822-fix-reset-pin-definitions.patch
-block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch
asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch
platform-x86-dell-wmi-ignore-suspend-notifications.patch
acpi-prm-clean-up-guid-type-in-struct-prm_handler_info.patch
+++ /dev/null
-From 2ff949441802a8d076d9013c7761f63e8ae5a9bd Mon Sep 17 00:00:00 2001
-From: Xinyu Zhang <xizhang@purestorage.com>
-Date: Wed, 23 Oct 2024 15:15:19 -0600
-Subject: block: fix sanity checks in blk_rq_map_user_bvec
-
-From: Xinyu Zhang <xizhang@purestorage.com>
-
-commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd upstream.
-
-blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which
-causes unnecessary failures in NVMe passthrough I/O, reproducible as
-follows:
-
-- register a 2 page, page-aligned buffer against a ring
-- use that buffer to do a 1 page io_uring NVMe passthrough read
-
-The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will
-then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so
-the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to
-fail. This failure is unnecessary, as when the check succeeds, it means
-we've checked the entire buffer that will be used by the request - i.e.
-blk_rq_map_user_bvec should complete successfully. Therefore, terminate
-the loop early and return successfully when the check bytes + bv->bv_len
-> nr_iter succeeds.
-
-While we're at it, also remove the check that all segments in the bvec
-are single-page. While this seems to be true for all users of the
-function, it doesn't appear to be required anywhere downstream.
-
-CC: stable@vger.kernel.org
-Signed-off-by: Xinyu Zhang <xizhang@purestorage.com>
-Co-developed-by: Uday Shankar <ushankar@purestorage.com>
-Signed-off-by: Uday Shankar <ushankar@purestorage.com>
-Fixes: 37987547932c ("block: extend functionality to map bvec iterator")
-Link: https://lore.kernel.org/r/20241023211519.4177873-1-ushankar@purestorage.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- block/blk-map.c | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
---- a/block/blk-map.c
-+++ b/block/blk-map.c
-@@ -600,9 +600,7 @@ static int blk_rq_map_user_bvec(struct r
- if (nsegs >= nr_segs || bytes > UINT_MAX - bv->bv_len)
- goto put_bio;
- if (bytes + bv->bv_len > nr_iter)
-- goto put_bio;
-- if (bv->bv_offset + bv->bv_len > PAGE_SIZE)
-- goto put_bio;
-+ break;
-
- nsegs++;
- bytes += bv->bv_len;
fgraph-change-the-name-of-cpuhp-state-to-fgraph-onli.patch
net-phy-dp83822-fix-reset-pin-definitions.patch
nfsd-fix-race-between-laundromat-and-free_stateid.patch
-block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch
drm-amd-display-temp-w-a-for-dp-link-layer-compliance.patch
ata-libata-set-did_time_out-for-commands-that-actually-timed-out.patch
asoc-sof-intel-hda-loader-do-not-wait-for-hdaudio-ioc.patch
+++ /dev/null
-From 2ff949441802a8d076d9013c7761f63e8ae5a9bd Mon Sep 17 00:00:00 2001
-From: Xinyu Zhang <xizhang@purestorage.com>
-Date: Wed, 23 Oct 2024 15:15:19 -0600
-Subject: block: fix sanity checks in blk_rq_map_user_bvec
-
-From: Xinyu Zhang <xizhang@purestorage.com>
-
-commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd upstream.
-
-blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which
-causes unnecessary failures in NVMe passthrough I/O, reproducible as
-follows:
-
-- register a 2 page, page-aligned buffer against a ring
-- use that buffer to do a 1 page io_uring NVMe passthrough read
-
-The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will
-then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so
-the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to
-fail. This failure is unnecessary, as when the check succeeds, it means
-we've checked the entire buffer that will be used by the request - i.e.
-blk_rq_map_user_bvec should complete successfully. Therefore, terminate
-the loop early and return successfully when the check bytes + bv->bv_len
-> nr_iter succeeds.
-
-While we're at it, also remove the check that all segments in the bvec
-are single-page. While this seems to be true for all users of the
-function, it doesn't appear to be required anywhere downstream.
-
-CC: stable@vger.kernel.org
-Signed-off-by: Xinyu Zhang <xizhang@purestorage.com>
-Co-developed-by: Uday Shankar <ushankar@purestorage.com>
-Signed-off-by: Uday Shankar <ushankar@purestorage.com>
-Fixes: 37987547932c ("block: extend functionality to map bvec iterator")
-Link: https://lore.kernel.org/r/20241023211519.4177873-1-ushankar@purestorage.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- block/blk-map.c | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
---- a/block/blk-map.c
-+++ b/block/blk-map.c
-@@ -600,9 +600,7 @@ static int blk_rq_map_user_bvec(struct r
- if (nsegs >= nr_segs || bytes > UINT_MAX - bv->bv_len)
- goto put_bio;
- if (bytes + bv->bv_len > nr_iter)
-- goto put_bio;
-- if (bv->bv_offset + bv->bv_len > PAGE_SIZE)
-- goto put_bio;
-+ break;
-
- nsegs++;
- bytes += bv->bv_len;
drm-amd-display-disable-psr-su-on-parade-08-01-tcon-too.patch
selinux-improve-error-checking-in-sel_write_load.patch
net-phy-dp83822-fix-reset-pin-definitions.patch
-block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch
ata-libata-set-did_time_out-for-commands-that-actually-timed-out.patch
asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch
platform-x86-dell-wmi-ignore-suspend-notifications.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
