diff options
| author | Christian A. Ehrhardt <lk@c--e.de> | 2026-03-26 22:49:02 +0100 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2026-04-02 23:36:23 -0700 |
| commit | 118cf3f55975352ac357fb194405031458186819 (patch) | |
| tree | 1a09d6764701c0d82ba0d332bf641697c901936a /lib | |
| parent | 07b7d66e65d9cfe6b9c2c34aa22cfcaac37a5c45 (diff) | |
| download | lwn-118cf3f55975352ac357fb194405031458186819.tar.gz lwn-118cf3f55975352ac357fb194405031458186819.zip | |
lib/scatterlist: fix temp buffer in extract_user_to_sg()
Instead of allocating a temporary buffer for extracted user pages
extract_user_to_sg() uses the end of the to be filled scatterlist as a
temporary buffer.
Fix the calculation of the start address if the scatterlist already
contains elements. The unused space starts at sgtable->sgl +
sgtable->nents not directly at sgtable->nents and the temporary buffer is
placed at the end of this unused space.
A subsequent commit will add kunit test cases that demonstrate that the
patch is necessary.
Pointed out by sashiko.dev on a previous iteration of this series.
Link: https://lkml.kernel.org/r/20260326214905.818170-3-lk@c--e.de
Fixes: 018584697533 ("netfs: Add a function to extract an iterator into a scatterlist")
Signed-off-by: Christian A. Ehrhardt <lk@c--e.de>
Cc: David Howells <dhowells@redhat.com>
Cc: David Gow <davidgow@google.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Petr Mladek <pmladek@suse.com>
Cc: <stable@vger.kernel.org> [v6.5+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/scatterlist.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/lib/scatterlist.c b/lib/scatterlist.c index befdc4b9c11d..b7fe91ef35b8 100644 --- a/lib/scatterlist.c +++ b/lib/scatterlist.c @@ -1123,8 +1123,7 @@ static ssize_t extract_user_to_sg(struct iov_iter *iter, size_t len, off; /* We decant the page list into the tail of the scatterlist */ - pages = (void *)sgtable->sgl + - array_size(sg_max, sizeof(struct scatterlist)); + pages = (void *)sg + array_size(sg_max, sizeof(struct scatterlist)); pages -= sg_max; do { |