]> git.ipfire.org Git - thirdparty/linux.git/commit
iomap: fix invalid folio access after folio_end_read()
authorJoanne Koong <joannelkoong@gmail.com>
Mon, 26 Jan 2026 22:41:07 +0000 (14:41 -0800)
committerChristian Brauner <brauner@kernel.org>
Thu, 29 Jan 2026 12:42:05 +0000 (13:42 +0100)
commitaa35dd5cbc060bc3e28ad22b1d76eefa3f024030
tree07c757ffbcd1db749873ed160465ce885e369da1
parent3431d387a7042c754e27152c287c6e706b46f139
iomap: fix invalid folio access after folio_end_read()

If the folio does not have an iomap_folio_state (ifs) attached and the
folio gets read in by the filesystem's IO helper, folio_end_read() will
be called by the IO helper at any time. For this case, we cannot access
the folio after dispatching it to the IO helper, eg subsequent accesses
like

        if (ctx->cur_folio &&
                    offset_in_folio(ctx->cur_folio, iter->pos) == 0) {

are incorrect.

Fix these invalid accesses by invalidating ctx->cur_folio if all bytes
of the folio have been read in by the IO helper.

This allows us to also remove the +1 bias added for the ifs case. The
bias was previously added to ensure that if all bytes are read in, the
IO helper does not end the read on the folio until iomap has decremented
the bias.

Fixes: b2f35ac4146d ("iomap: add caller-provided callbacks for read and readahead")
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Link: https://patch.msgid.link/20260126224107.2182262-2-joannelkoong@gmail.com
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
fs/iomap/buffered-io.c