[PATCH] block: advance iterator after copy-in for SG_DXFER_TO_FROM_DEV

[PATCH] block: advance iterator after copy-in for SG_DXFER_TO_FROM_DEV

[TJ Adams]

When a passthrough request uses transfer direction SG_DXFER_TO_FROM_DEV,
bio_copy_user_iov() sets up a temporary iterator iter2 with
data_source = ITER_SOURCE to copy user data into the bio pages before
execution.

bio_copy_from_iter(bio, &iter2) copies the data and advances iter2, but
the original iter is never advanced. Consequently, iov_iter_count(&i)
remains non-zero in the caller loop in blk_rq_map_user_iov():

	i = *iter;
	do {
		if (copy)
			ret = bio_copy_user_iov(rq, map_data, &i, gfp_mask);
...
	} while (iov_iter_count(&i));

Because i is never advanced, blk_rq_map_user_iov() loops indefinitely,
continually allocating bios and consuming map_data pages until it
exhausts pages and fails with -EINVAL.

Fix this by calling iov_iter_advance(iter, bio->bi_iter.bi_size) in the
map_data && map_data->from_user branch after bio_copy_from_iter().

Fixes: 13f3956eb568 ("block: Fix WARNING in _copy_from_iter")
Signed-off-by: Terrence Adams <tadamsjr@google.com>
Assisted-by: LLM
---
 block/blk-map.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/blk-map.c b/block/blk-map.c
index 9cb9605d1f62..2685f6177ceb 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -236,6 +236,7 @@ static int bio_copy_user_iov(struct request *rq, struct rq_map_data *map_data,
 		ret = bio_copy_from_iter(bio, &iter2);
 		if (ret)
 			goto cleanup;
+		iov_iter_advance(iter, bio->bi_iter.bi_size);
 	} else {
 		if (bmd->is_our_pages)
 			zero_fill_bio(bio);
-- 
2.56.0.rc1.315.gc6ed9934b7-goog

Re: [PATCH] block: advance iterator after copy-in for SG_DXFER_TO_FROM_DEV

[TJ Adams]

On Tue, Sep 29, 2026 at 9:08 AM TJ Adams <tadamsjr@google.com> wrote:
>
> When a passthrough request uses transfer direction SG_DXFER_TO_FROM_DEV,
> bio_copy_user_iov() sets up a temporary iterator iter2 with
...
>                 ret = bio_copy_from_iter(bio, &iter2);
>                 if (ret)
>                         goto cleanup;
> +               iov_iter_advance(iter, bio->bi_iter.bi_size);
>         } else {
>                 if (bmd->is_our_pages)
>                         zero_fill_bio(bio);
> --
> 2.56.0.rc1.315.gc6ed9934b7-goog

Gentle ping on this fix. Please let me know if you have any questions or
feedback.

Thanks,
TJ Adams

Re: [PATCH] block: advance iterator after copy-in for SG_DXFER_TO_FROM_DEV

[Christian A . Ehrhardt]

Hi,

On Tue, Sep 29, 2026 at 09:08:13AM -0700, TJ Adams wrote:
> When a passthrough request uses transfer direction SG_DXFER_TO_FROM_DEV,
> bio_copy_user_iov() sets up a temporary iterator iter2 with
> data_source = ITER_SOURCE to copy user data into the bio pages before
> execution.
> 
> bio_copy_from_iter(bio, &iter2) copies the data and advances iter2, but
> the original iter is never advanced. Consequently, iov_iter_count(&i)
> remains non-zero in the caller loop in blk_rq_map_user_iov():
> 
> 	i = *iter;
> 	do {
> 		if (copy)
> 			ret = bio_copy_user_iov(rq, map_data, &i, gfp_mask);
> ...
> 	} while (iov_iter_count(&i));
> 
> Because i is never advanced, blk_rq_map_user_iov() loops indefinitely,
> continually allocating bios and consuming map_data pages until it
> exhausts pages and fails with -EINVAL.
> 
> Fix this by calling iov_iter_advance(iter, bio->bi_iter.bi_size) in the
> map_data && map_data->from_user branch after bio_copy_from_iter().

Sorry for being lazy on this (and for messing it up).

Acked-by: Christian A. Ehrhardt <lk@c--e.de>

Thanks,
Christian

> 
> Fixes: 13f3956eb568 ("block: Fix WARNING in _copy_from_iter")
> Signed-off-by: Terrence Adams <tadamsjr@google.com>
> Assisted-by: LLM
> ---
>  block/blk-map.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/block/blk-map.c b/block/blk-map.c
> index 9cb9605d1f62..2685f6177ceb 100644
> --- a/block/blk-map.c
> +++ b/block/blk-map.c
> @@ -236,6 +236,7 @@ static int bio_copy_user_iov(struct request *rq, struct rq_map_data *map_data,
>  		ret = bio_copy_from_iter(bio, &iter2);
>  		if (ret)
>  			goto cleanup;
> +		iov_iter_advance(iter, bio->bi_iter.bi_size);
>  	} else {
>  		if (bmd->is_our_pages)
>  			zero_fill_bio(bio);
> -- 
> 2.56.0.rc1.315.gc6ed9934b7-goog
> 
> 

Re: [PATCH] block: advance iterator after copy-in for SG_DXFER_TO_FROM_DEV

[Jens Axboe]

On Tue, 29 Sep 2026 09:08:13 -0700, TJ Adams wrote:
> When a passthrough request uses transfer direction SG_DXFER_TO_FROM_DEV,
> bio_copy_user_iov() sets up a temporary iterator iter2 with
> data_source = ITER_SOURCE to copy user data into the bio pages before
> execution.
> 
> bio_copy_from_iter(bio, &iter2) copies the data and advances iter2, but
> the original iter is never advanced. Consequently, iov_iter_count(&i)
> remains non-zero in the caller loop in blk_rq_map_user_iov():
> 
> [...]

Applied, thanks!

[1/1] block: advance iterator after copy-in for SG_DXFER_TO_FROM_DEV
      commit: 82e72ea18d0af724914c31a1f274c1aef452aad0

Best regards,
-- 
Jens Axboe