From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B270821C160 for ; Thu, 26 Mar 2026 22:39:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774564790; cv=none; b=BM8jdy3PseTfir7ptKd3CuF3frReMr7usyhcrdU1UI+bd3GHlHGV2cHBp6ogjfpQotFPKRS3tpVmma+ZL6RN90NQu+t4HClHi6e9/q6m9tnSjrHZtDV5ixSTACk5Vf0kNXnLLRoEK+B9VHeOWMuScrMt5EAcyyKeOw9wLEVThk4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774564790; c=relaxed/simple; bh=Ar89DA0Qvkz+J6LIvf8YOpqaYvYr8zAeqxbKi85xXJ8=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=mURIwiMRvHVGqYaTjArNQoY96crnEyq578VqatMJTFPbwZGn6gDZC41ziK4bWQBv575OOSX4ZQLJJvYt0uUuS/zuT9b3Ckv31/OkvCt33qdzb7EQ0lpVE8UIvtUjLRHkmSwLrwoRxHTZRpRLq4cN1ViGPSi3PddKCxUc2Y0pflM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=nOUQ/rX5; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="nOUQ/rX5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17F68C19423; Thu, 26 Mar 2026 22:39:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1774564790; bh=Ar89DA0Qvkz+J6LIvf8YOpqaYvYr8zAeqxbKi85xXJ8=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=nOUQ/rX5i8fpAxWKe17Ny1ShE8WnfoI+ru+XbGoWufW8R244978rG5YY0g9afPIlA RhJolTXMJKiRp70DDH5tihzVi7BIFM0ReSF3YCcqrEKKIvJxPahigKXMIO8kfWClfh bUcQFEa0bYVUVAFgkyMhgYP202VY+dOfQY23wz2Y= Date: Thu, 26 Mar 2026 15:39:49 -0700 From: Andrew Morton To: "Christian A. Ehrhardt" Cc: David Howells , linux-kernel@vger.kernel.org, Kees Cook , Petr Mladek , David Gow Subject: Re: [PATCH v3 0/5] Fix bugs in extract_iter_to_sg() Message-Id: <20260326153949.ecbd4ba14255c301a8096b3f@linux-foundation.org> In-Reply-To: <20260326214905.818170-1-lk@c--e.de> References: <20260326214905.818170-1-lk@c--e.de> X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Thu, 26 Mar 2026 22:49:00 +0100 "Christian A. Ehrhardt" wrote: > Fix bugs in the kvec and user variants of extract_iter_to_sg. > This series is growing due to useful remarks made by sashiko.dev. > > The main bugs are: > - The length for an sglist entry when extracting from > a kvec can exceed the number of bytes in the page. This > is obviously not intended. > - When extracting a user buffer the sglist is temporarily > used as a scratch buffer for extracted page pointers. > If the sglist already contains some elements this scratch > buffer could overlap with existing entries in the sglist. > > The series adds test cases to the kunit_iov_iter test that > demonstrate all of these bugs. Additionally, there is a > memory leak fix for the test itself. > > The bugs were orignally introduced into kernel v6.3 where the > function lived in fs/netfs/iterator.c. It was later moved > to lib/scatterlist.c in v6.5. Thus the actual fix is only > marked for backports to v6.5+. Great. I'll add this to mm.git's mm-unstable branch, targetting an upstream merge into 7.1-rc1. As far as I understand, this means that the cc:stable patches will be presented to the -stable maintainers some time after that upstreaming. I don't believe that more urgency is needed. DavidH, please review the sg changes? DavidG, please check the kunit changes? Thanks all.