diff options
| author |   David Carlier <devnexen@gmail.com> | 2026-05-11 22:51:51 +0100 |
|---|---|---|
| committer |   Jens Axboe <axboe@kernel.dk> | 2026-05-12 09:23:31 -0600 |
| commit | 637ad3a56a3b889527d1dacea6fea2a8bd648140 (patch) | |
| tree | ac3d11b7113ab5b50d6ebcfd932e4f6a0038d947 /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation (diff) | |
block: don't overwrite bip_vcnt in bio_integrity_copy_user()
bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce
segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt
on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h
read past the bip_vec[] flex array. On READ the read is in bounds
but lands on a saved user bvec instead of the bounce.
The line was added for split propagation, but bio_integrity_clone()
doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.
Fixes: 3991657ae707 ("block: set bip_vcnt correctly")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511215151.346228-1-devnexen@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions