Re: [PATCH v2] iov_iter: validate extracted segment for bvec alignment

[Andrew Morton]

On Thu, 15 Oct 2026 15:19:07 +0900 Daehyeon Ko <4ncienth@xxxxxxxxx> wrote:

> iov_iter_extract_bvecs() validates iter_iov_addr() and iter_iov_len()
> before iov_iter_extract_pages() selects the first nonempty segment and
> limits it by iter->count.  The checks can therefore cover a different range
> after a leading empty segment or iov_iter_truncate().
> 
> An unprivileged O_DIRECT preadv() reproduced the empty-segment case: an
> aligned empty segment followed by a misaligned one completed 4096 bytes
> instead of returning -EINVAL.  A truncated iterator has the same mismatch
> when its full segment length is aligned but its remaining count is not.
> 
> Bound the normal fast-path length by iter->count.  Keep
> first_iovec_segment() for leading empty segments so validation covers the
> remaining portion of the segment available for extraction.

Thanks.

I'd like to understand the worst-case userspace-visible runtime effects
of this bug.  As far as I understand, the existing bug can result in
misaligned DMA requests getting all the way down to the device driver,
yes?

If so, hopefully the driver and the hardware will handle this elegantly
(hah), but there are so many drivers and they aren't the best code
we've ever produced.

Your patch has cc:stable and I agree with that decision.  Jens?