block: fix aligning of bounced dio read bios

bio_iov_iter_align_down expects the "normal" biovec layout from vector 0,
while bio_iov_iter_bounce_read abuses vector 0 for a bounce buffer
allocation.  Pass an explicit bvec to bio_iov_iter_align_down to deal
with this case to avoid a double unpin.

Additionally we need to free the folio if no bio_vec could be added,
and adjust the size of the first bio_vec that contains the bounce buffer
when the I/O size is aligned down.

Fixes: e7b8b3c5b2a6 ("block: align down bounces bios")
Reported-by: 0wnerD1ed <l7z@0b1t.tech>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Tested-by: 0wnerD1ed <l7z@0b1t.tech>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Link: https://patch.msgid.link/20260716091306.316625-3-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/block/bio.c b/block/bio.c
index ebb6d3e53ac39e359dd1da7c2e3a28b6e429a48f..6a2f6fc3413e895d8bfdbcbb72822e2a03f1874f 100644 (file)
--- a/block/bio.c
+++ b/block/bio.c
@@ -1199,7 +1199,7 @@ void bio_iov_bvec_set(struct bio *bio, const struct iov_iter *iter)
  * for the next iteration.
  */
 static int bio_iov_iter_align_down(struct bio *bio, struct iov_iter *iter,
-                           unsigned len_align_mask)
+                                  struct bio_vec *bv, unsigned len_align_mask)
 {
        size_t nbytes = bio->bi_iter.bi_size & len_align_mask;
 
@@ -1208,23 +1208,16 @@ static int bio_iov_iter_align_down(struct bio *bio, struct iov_iter *iter,
 
        iov_iter_revert(iter, nbytes);
        bio->bi_iter.bi_size -= nbytes;
-       do {
-               struct bio_vec *bv = &bio->bi_io_vec[bio->bi_vcnt - 1];
-
-               if (nbytes < bv->bv_len) {
-                       bv->bv_len -= nbytes;
-                       break;
-               }
-
+       while (nbytes >= bv->bv_len) {
                if (bio_flagged(bio, BIO_PAGE_PINNED))
                        unpin_user_page(bv->bv_page);
 
-               bio->bi_vcnt--;
+               if (!--bio->bi_vcnt)
+                       return -EFAULT;
                nbytes -= bv->bv_len;
-       } while (nbytes);
-
-       if (!bio->bi_vcnt)
-               return -EFAULT;
+               bv--;
+       }
+       bv->bv_len -= nbytes;
        return 0;
 }
 
@@ -1284,7 +1277,8 @@ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter,
 
        if (is_pci_p2pdma_page(bio->bi_io_vec->bv_page))
                bio->bi_opf |= REQ_NOMERGE;
-       return bio_iov_iter_align_down(bio, iter, len_align_mask);
+       return bio_iov_iter_align_down(bio, iter,
+                       &bio->bi_io_vec[bio->bi_vcnt - 1], len_align_mask);
 }
 
 static struct folio *folio_alloc_greedy(gfp_t gfp, size_t *size,
@@ -1369,7 +1363,8 @@ static int bio_iov_iter_bounce_write(struct bio *bio, struct iov_iter *iter,
 
        if (!bio->bi_iter.bi_size)
                return -ENOMEM;
-       return bio_iov_iter_align_down(bio, iter, minsize - 1);
+       return bio_iov_iter_align_down(bio, iter,
+                       &bio->bi_io_vec[bio->bi_vcnt - 1], minsize - 1);
 }
 
 static int bio_iov_iter_bounce_read(struct bio *bio, struct iov_iter *iter,
@@ -1377,21 +1372,18 @@ static int bio_iov_iter_bounce_read(struct bio *bio, struct iov_iter *iter,
 {
        size_t len = min3(iov_iter_count(iter), maxlen, SZ_1M);
        struct folio *folio;
+       ssize_t ret;
 
        folio = folio_alloc_greedy(GFP_KERNEL, &len, minsize);
        if (!folio)
                return -ENOMEM;
 
        do {
-               ssize_t ret;
-
                ret = iov_iter_extract_bvecs(iter, bio->bi_io_vec + 1, len,
                                &bio->bi_vcnt, bio->bi_max_vecs - 1, 0);
                if (ret <= 0) {
-                       if (!bio->bi_vcnt) {
-                               folio_put(folio);
-                               return ret;
-                       }
+                       if (!bio->bi_vcnt)
+                               goto out_folio_put;
                        break;
                }
                len -= ret;
@@ -1407,7 +1399,20 @@ static int bio_iov_iter_bounce_read(struct bio *bio, struct iov_iter *iter,
        bvec_set_folio(&bio->bi_io_vec[0], folio, bio->bi_iter.bi_size, 0);
        if (iov_iter_extract_will_pin(iter))
                bio_set_flag(bio, BIO_PAGE_PINNED);
-       return bio_iov_iter_align_down(bio, iter, minsize - 1);
+
+       /* The first vec stores the bounce buffer, so do not subtract 1 here. */
+       ret = bio_iov_iter_align_down(bio, iter,
+                       &bio->bi_io_vec[bio->bi_vcnt], minsize - 1);
+       if (ret)
+               goto out_folio_put;
+
+       /* Update the bounc buffer bv_len to the aligned down size. */
+       bio->bi_io_vec[0].bv_len = bio->bi_iter.bi_size;
+       return 0;
+
+out_folio_put:
+       folio_put(folio);
+       return ret;
 }
 
 /**