OpenVZ / Virtuozzo kernel development (devel@openvz.org)
 help / color / mirror / Atom feed
From: Liu Kui <kui.liu@virtuozzo.com>
To: Konstantin Khorenko <khorenko@virtuozzo.com>
Cc: azaitsev@virtuozzo.com, devel@openvz.org,
	Liu Kui <kui.liu@virtuozzo.com>
Subject: [Devel] [PATCH hci-8.1 2/2] fs/fuse kio: check every touched page in iov_iter_sendpages_ok()
Date: Thu, 01 Oct 2026 11:23:42 +0800	[thread overview]
Message-ID: <20261001-sockio-sendmsg-empty-iter-v1-2-b876f4fbb9c7@virtuozzo.com> (raw)
In-Reply-To: <20261001-sockio-sendmsg-empty-iter-v1-0-b876f4fbb9c7@virtuozzo.com>

A bvec with an unaligned bv_offset can cross into one more page than
sendpages_ok() checks, so fold the intra-page offset into len. Pure
hardening: today the skipped page can never fail sendpage_ok().

https://virtuozzo.atlassian.net/browse/VSTOR-142167

Fixes: 32b44dc7ba67 ("fs/fuse kio: refactor transmit path in pcs_sockio_send()")
Signed-off-by: Liu Kui <kui.liu@virtuozzo.com>
---
 fs/fuse/kio/pcs/pcs_sock_io.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/kio/pcs/pcs_sock_io.c b/fs/fuse/kio/pcs/pcs_sock_io.c
index b4a2ceeb331c..753a85a560bc 100644
--- a/fs/fuse/kio/pcs/pcs_sock_io.c
+++ b/fs/fuse/kio/pcs/pcs_sock_io.c
@@ -272,7 +272,13 @@ static bool iov_iter_sendpages_ok(struct iov_iter *it)
 		return false;
 
 	while (bvec < (it->bvec + it->nr_segs)) {
-		if (!sendpages_ok(bvec->bv_page, bvec->bv_len, bvec->bv_offset))
+		/*
+		 * Fold the intra-page offset into len so sendpages_ok()
+		 * checks every page the range touches.
+		 */
+		if (!sendpages_ok(bvec->bv_page,
+				  (bvec->bv_offset & ~PAGE_MASK) + bvec->bv_len,
+				  bvec->bv_offset & PAGE_MASK))
 			return false;
 		bvec++;
 	}

-- 
Git-155)

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

  parent reply	other threads:[~2026-10-01  3:25 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-01  3:23 [Devel] [PATCH hci-8.1 0/2] fs/fuse kio: two fixes for the sockio transmit refactor Liu Kui
2026-10-01  3:23 ` [Devel] [PATCH hci-8.1 1/2] fs/fuse kio: don't spin on an empty iter in do_sockio_sendmsg() Liu Kui
2026-10-01  3:26   ` no-reply
2026-10-01  3:23 ` Liu Kui [this message]
2026-10-01  3:26   ` [Devel] [PATCH hci-8.1 2/2] fs/fuse kio: check every touched page in iov_iter_sendpages_ok() no-reply
2026-10-01 12:05 ` [Devel] [PATCH hci-8.1 0/2] fs/fuse kio: two fixes for the sockio transmit refactor Konstantin Khorenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261001-sockio-sendmsg-empty-iter-v1-2-b876f4fbb9c7@virtuozzo.com \
    --to=kui.liu@virtuozzo.com \
    --cc=azaitsev@virtuozzo.com \
    --cc=devel@openvz.org \
    --cc=khorenko@virtuozzo.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox