Re: [PATCH] iov_iter: validate first nonempty segment for bvec alignment

[Andrew Morton]

On Mon, 12 Oct 2026 15:55:20 +0900 Daehyeon Ko <4ncienth@xxxxxxxxx> wrote:

> iov_iter_extract_bvecs() checks the current IOVEC or KVEC segment against
> the block device's DMA alignment before extracting pages.  Empty segments
> are valid, but the check uses iter_iov_addr() and iter_iov_len() directly
> while first_iovec_segment(), used by the extraction path, skips them.
> 
> An aligned empty segment followed by a misaligned nonempty segment
> therefore passes the check and produces misaligned bvecs.  An unprivileged
> O_DIRECT preadv() reproduced this on a regular ext4 file above brd.  The
> equivalent nonempty-leading vector returned -EINVAL, while the
> empty-leading vector completed 4096 bytes.  This bypasses the validation
> added for CVE-2026-89584.
> 
> When the current segment is empty but the iterator still contains data, use
> first_iovec_segment() to select and validate the same segment that page
> extraction will use.  Keep the existing constant-time fast path for the
> normal nonempty case.

Thanks.

Sashiko:
	https://sashiko.dev/#/patchset/20261012065520.1089147-1-4ncienth@xxxxxxxxx

It looks like that issue is pre-existing, but could also be addressed
by altering your proposed change.