Re: [BUG] KASAN: slab-out-of-bounds Read in copy_folio_from_iter_atomic

[Li Zao]

On Mon, Oct 19, 2026 at 9:37 AM Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:

> Thanks.  Boy I burned a lot of tokens on this.
>
> I was able to reproduce this.  I found that Daehyeon's "iov_iter:
> validate extracted segment for bvec alignment" makes the KASAN warnings
> go away.  https://lore.kernel.org/20261015061907.2713943-1-4ncienth@xxxxxxxxx
>
> Daehyeon's patch is presently in mm.git's mm-unstable branch, with
> cc:stable, targeted for upstreaming during the second week of the merge
> window.
>
> Daehyeon's patch prevents this reproducer from triggering the bug by
> rejecting the misaligned direct-I/O request before extraction advances
> the iterator.  Without that check, extraction skips the initial empty
> iovec and the following 10-byte segment, then encounters an alignment
> error.  The bio is discarded, but the iterator remains advanced.  iomap
> subsequently restores its byte count without restoring its position,
> leaving 1025 bytes recorded when only 1015 remain.  Buffered-I/O
> fallback then walks beyond the imported iovec array.  So Daehyeon's
> patch avoids the bad path, but doesn't address the underlying failure
> to restore the iterator when rejecting a bio.


Hi,

Thanks for investigating the issue and preparing a patch.

I was wondering whether a CVE ID would be assigned to this vulnerability.
The CVE ID is important for our research, and we'd appreciate any update.

Best regards,
Haocheng Yu