qiurui
/
linux-kernelorg-stable
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

block: don't revert iter for -EIOCBQUEUED 

blkdev_read_iter() has a few odd checks, like gating the position and
count adjustment on whether or not the result is bigger-than-or-equal to
zero (where bigger than makes more sense), and not checking the return
value of blkdev_direct_IO() before doing an iov_iter_revert(). The
latter can lead to attempting to revert with a negative value, which
when passed to iov_iter_revert() as an unsigned value will lead to
throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT.

Be sane and don't revert for -EIOCBQUEUED, like what is done in other
spots.

Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Jens Axboe 2025-01-23 06:18:41 -07:00
parent 7004a2e46d
commit b13ee668e8
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
block/fops.c
View File

@ -783,11 +783,12 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
file_accessed(iocb->ki_filp); file_accessed(iocb->ki_filp);
ret = blkdev_direct_IO(iocb, to); ret = blkdev_direct_IO(iocb, to);
if (ret >= 0) { if (ret > 0) {
iocb->ki_pos += ret; iocb->ki_pos += ret;
count -= ret; count -= ret;
} }
iov_iter_revert(to, count - iov_iter_count(to)); if (ret != -EIOCBQUEUED)
iov_iter_revert(to, count - iov_iter_count(to));
if (ret < 0 || !count) if (ret < 0 || !count)
goto reexpand; goto reexpand;
} }