Re: [PATCH 1/4] virtio_console: copy pipe buffers in splice_write()

[Christian Brauner <brauner@kernel.org>]

On Wed, Nov 11, 2026 at 01:36:37PM +0100, Christian Brauner wrote:
> So we need to copy per page which would fix both.

So the fix below is what we've done before for pipes and I think it's
the right thing to do here too. I put the following on vfs.fixes:

-- >8 --
From: Christian Brauner <brauner@kernel.org>
Subject: [PATCH] virtio_console: copy pipe buffers that span multiple pages

pipe_to_sg() maps buf->page with kmap_local_page() and then copies up
to a page worth of data starting at buf->offset. But kmap_local_page()
only maps a single page and a pipe buffer can span multiple pages of a
compound page with buf->offset pointing past the first one:

- skb_splice_bits() for AF_UNIX and TCP sockets
- tracing_buffers_splice_read() with sub-buffers larger than a page
- fuse_dev_splice_read() which hands out the page cache folios of WRITE
  requests. Those can be large folios since b46e09667411 ("fuse: enable
  large folios").

Without HIGHMEM this happens to work because kmap_local_page() is just
page_address() and a compound page is contiguous in the direct map.
With HIGHMEM the copy reads past the mapping. A fuse server on a 32-bit
HIGHMEM guest that splices a WRITE request into a virtio port crashes:

  BUG: unable to handle page fault for address: fffab000
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  Oops: Oops: 0000 [#1] SMP
  EIP: pipe_to_sg+0x158/0x1e0
  Call Trace:
   __splice_from_pipe+0xd6/0x1f0
   port_fops_splice_write+0xf9/0x170
   do_splice+0x2c1/0x810
   __ia32_sys_splice+0x2e7/0x310
   ia32_sys_call+0x1916/0x2510
   __do_fast_syscall_32+0xd4/0x550
   do_fast_syscall_32+0x32/0x70
   do_SYSENTER_32+0x15/0x20
   entry_SYSENTER_32+0xa6/0x115

pipe_read() had the same problem and 08aa64796016 ("teach
copy_page_to_iter() to handle compound pages") fixed it by mapping one
subpage at a time. So copy the buffer with copy_page_to_iter() as well.

Fixes: b46e09667411 ("fuse: enable large folios")
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
 drivers/char/virtio_console.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index b1b1aaf43e07e..b93a31b81cf4e 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -12,6 +12,7 @@
 #include <linux/freezer.h>
 #include <linux/fs.h>
 #include <linux/splice.h>
+#include <linux/uio.h>
 #include <linux/pagemap.h>
 #include <linux/idr.h>
 #include <linux/init.h>
@@ -891,8 +892,9 @@ static int pipe_to_sg(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
 {
 	struct sg_list *sgl = sd->u.data;
 	unsigned int offset, len;
+	struct iov_iter to;
 	struct page *page;
-	char *src;
+	struct kvec kv;
 
 	if (sgl->n == sgl->size)
 		return 0;
@@ -907,9 +909,14 @@ static int pipe_to_sg(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
 	if (len + offset > PAGE_SIZE)
 		len = PAGE_SIZE - offset;
 
-	src = kmap_local_page(buf->page);
-	memcpy(page_address(page) + offset, src + buf->offset, len);
-	kunmap_local(src);
+	/* The buffer can span several pages of a compound page. */
+	kv.iov_base = page_address(page) + offset;
+	kv.iov_len = len;
+	iov_iter_kvec(&to, ITER_DEST, &kv, 1, len);
+	if (copy_page_to_iter(buf->page, buf->offset, len, &to) != len) {
+		__free_page(page);
+		return -EFAULT;
+	}
 
 	sg_set_page(&sgl->sg[sgl->n], page, len, offset);
 	sgl->n++;

--