Re: [PATCH v3 0/5] Fix bugs in extract_iter_to_sg()

[Andrew Morton <akpm@linux-foundation.org>]

On Thu, 26 Mar 2026 22:49:00 +0100 "Christian A. Ehrhardt" <lk@c--e.de> wrote:

> Fix bugs in the kvec and user variants of extract_iter_to_sg.
> This series is growing due to useful remarks made by sashiko.dev.
> 
> The main bugs are:
> - The length for an sglist entry when extracting from
>   a kvec can exceed the number of bytes in the page. This
>   is obviously not intended.
> - When extracting a user buffer the sglist is temporarily
>   used as a scratch buffer for extracted page pointers.
>   If the sglist already contains some elements this scratch
>   buffer could overlap with existing entries in the sglist.
> 
> The series adds test cases to the kunit_iov_iter test that
> demonstrate all of these bugs. Additionally, there is a
> memory leak fix for the test itself.
> 
> The bugs were orignally introduced into kernel v6.3 where the
> function lived in fs/netfs/iterator.c. It was later moved
> to lib/scatterlist.c in v6.5. Thus the actual fix is only
> marked for backports to v6.5+.

Great.  I'll add this to mm.git's mm-unstable branch, targetting an
upstream merge into 7.1-rc1.

As far as I understand, this means that the cc:stable patches will be
presented to the -stable maintainers some time after that upstreaming. 
I don't believe that more urgency is needed.

DavidH, please review the sg changes?

DavidG, please check the kunit changes?

Thanks all.