Re: [syzbot] [netfs?] kernel BUG in netfs_limit_iter

[David Howells]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c107785c7e8d

commit c4449647436e654c150cf5fdb70a64a9d02283a1
Author: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
Date:   Sat Mar 7 14:30:41 2026 +0530

    netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
    
    When a process crashes and the kernel writes a core dump to a 9P
    filesystem, __kernel_write() creates an ITER_KVEC iterator. This
    iterator reaches netfs_limit_iter() via netfs_unbuffered_write(), which
    only handles ITER_FOLIOQ, ITER_BVEC and ITER_XARRAY iterator types,
    hitting the BUG() for any other type.
    
    Fix this by adding netfs_limit_kvec() following the same pattern as
    netfs_limit_bvec(), since both kvec and bvec are simple segment arrays
    with pointer and length fields. Dispatch it from netfs_limit_iter() when
    the iterator type is ITER_KVEC.
    
    Fixes: cae932d3aee5 ("netfs: Add func to calculate pagecount/size-limited span of an iterator")
    Reported-by: syzbot+9c058f0d63475adc97fd@xxxxxxxxxxxxxxxxxxxxxxxxx
    Closes: https://syzkaller.appspot.com/bug?extid=9c058f0d63475adc97fd
    Tested-by: syzbot+9c058f0d63475adc97fd@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Deepanshu Kartikey <Kartikey406@xxxxxxxxx>
    Signed-off-by: David Howells <dhowells@xxxxxxxxxx>

diff --git a/fs/netfs/iterator.c b/fs/netfs/iterator.c
index 72a435e5fc6d..154a14bb2d7f 100644
--- a/fs/netfs/iterator.c
+++ b/fs/netfs/iterator.c
@@ -142,6 +142,47 @@ static size_t netfs_limit_bvec(const struct iov_iter *iter, size_t start_offset,
 	return min(span, max_size);
 }
 
+/*
+ * Select the span of a kvec iterator we're going to use.  Limit it by both
+ * maximum size and maximum number of segments.  Returns the size of the span
+ * in bytes.
+ */
+static size_t netfs_limit_kvec(const struct iov_iter *iter, size_t start_offset,
+			       size_t max_size, size_t max_segs)
+{
+	const struct kvec *kvecs = iter->kvec;
+	unsigned int nkv = iter->nr_segs, ix = 0, nsegs = 0;
+	size_t len, span = 0, n = iter->count;
+	size_t skip = iter->iov_offset + start_offset;
+
+	if (WARN_ON(!iov_iter_is_kvec(iter)) ||
+	    WARN_ON(start_offset > n) ||
+	    n == 0)
+		return 0;
+
+	while (n && ix < nkv && skip) {
+		len = kvecs[ix].iov_len;
+		if (skip < len)
+			break;
+		skip -= len;
+		n -= len;
+		ix++;
+	}
+
+	while (n && ix < nkv) {
+		len = min3(n, kvecs[ix].iov_len - skip, max_size);
+		span += len;
+		nsegs++;
+		ix++;
+		if (span >= max_size || nsegs >= max_segs)
+			break;
+		skip = 0;
+		n -= len;
+	}
+
+	return min(span, max_size);
+}
+
 /*
  * Select the span of an xarray iterator we're going to use.  Limit it by both
  * maximum size and maximum number of segments.  It is assumed that segments
@@ -245,6 +286,8 @@ size_t netfs_limit_iter(const struct iov_iter *iter, size_t start_offset,
 		return netfs_limit_bvec(iter, start_offset, max_size, max_segs);
 	if (iov_iter_is_xarray(iter))
 		return netfs_limit_xarray(iter, start_offset, max_size, max_segs);
+	if (iov_iter_is_kvec(iter))
+		return netfs_limit_kvec(iter, start_offset, max_size, max_segs);
 	BUG();
 }
 EXPORT_SYMBOL(netfs_limit_iter);