Re: [PATCH] block: advance iterator after copy-in for SG_DXFER_TO_FROM_DEV

[Christian A . Ehrhardt]

Hi,

On Tue, Sep 29, 2026 at 09:08:13AM -0700, TJ Adams wrote:
> When a passthrough request uses transfer direction SG_DXFER_TO_FROM_DEV,
> bio_copy_user_iov() sets up a temporary iterator iter2 with
> data_source = ITER_SOURCE to copy user data into the bio pages before
> execution.
> 
> bio_copy_from_iter(bio, &iter2) copies the data and advances iter2, but
> the original iter is never advanced. Consequently, iov_iter_count(&i)
> remains non-zero in the caller loop in blk_rq_map_user_iov():
> 
> 	i = *iter;
> 	do {
> 		if (copy)
> 			ret = bio_copy_user_iov(rq, map_data, &i, gfp_mask);
> ...
> 	} while (iov_iter_count(&i));
> 
> Because i is never advanced, blk_rq_map_user_iov() loops indefinitely,
> continually allocating bios and consuming map_data pages until it
> exhausts pages and fails with -EINVAL.
> 
> Fix this by calling iov_iter_advance(iter, bio->bi_iter.bi_size) in the
> map_data && map_data->from_user branch after bio_copy_from_iter().

Sorry for being lazy on this (and for messing it up).

Acked-by: Christian A. Ehrhardt <lk@xxxxxxx>

Thanks,
Christian

> 
> Fixes: 13f3956eb568 ("block: Fix WARNING in _copy_from_iter")
> Signed-off-by: Terrence Adams <tadamsjr@xxxxxxxxxx>
> Assisted-by: LLM
> ---
>  block/blk-map.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/block/blk-map.c b/block/blk-map.c
> index 9cb9605d1f62..2685f6177ceb 100644
> --- a/block/blk-map.c
> +++ b/block/blk-map.c
> @@ -236,6 +236,7 @@ static int bio_copy_user_iov(struct request *rq, struct rq_map_data *map_data,
>  		ret = bio_copy_from_iter(bio, &iter2);
>  		if (ret)
>  			goto cleanup;
> +		iov_iter_advance(iter, bio->bi_iter.bi_size);
>  	} else {
>  		if (bmd->is_our_pages)
>  			zero_fill_bio(bio);
> -- 
> 2.56.0.rc1.315.gc6ed9934b7-goog
> 
>