]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages()
authorDavid Howells <dhowells@redhat.com>
Thu, 25 Jun 2026 14:06:23 +0000 (15:06 +0100)
committerChristian Brauner <brauner@kernel.org>
Wed, 1 Jul 2026 13:26:28 +0000 (15:26 +0200)
commit55f4bb9373ca4a521f3b0119366db92715a39b81
treea6143b8c2e019399caa322dc8486e27046322970
parent511a018ed2afd8d415edd307ce7ad2048506f6a1
iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages()

In iov_iter_extract_xarray_pages(), if no pages are extracted because
there's a hole (or something otherwise unextractable) in the xarray, then
the calculation of maxsize at the end can go wrong if the starting offset
is not zero.

Fix this by returning 0 in such a case and freeing the page array if
allocated here rather than being passed in.

Note that in the near future, ITER_XARRAY should be removed.

Fixes: 7d58fe731028 ("iov_iter: Add a function to extract a page list from an iterator")
Link: https://sashiko.dev/#/patchset/20260608145432.681865-1-dhowells%40redhat.com
Link: https://sashiko.dev/#/patchset/20260616100821.2062304-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260625140640.3116900-6-dhowells@redhat.com
Reviewed-by: Christoph Hellwig <hch@lst.de>
cc: Paulo Alcantara <pc@manguebit.org>
cc: Matthew Wilcox <willy@infradead.org>
cc: Christoph Hellwig <hch@infradead.org>
cc: Jens Axboe <axboe@kernel.dk>
cc: Mike Marshall <hubcap@omnibond.com>
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
lib/iov_iter.c