From 82e72ea18d0af724914c31a1f274c1aef452aad0 Mon Sep 17 00:00:00 2001 From: TJ Adams Date: Tue, 29 Sep 2026 09:08:13 -0700 Subject: [PATCH] block: advance iterator after copy-in for SG_DXFER_TO_FROM_DEV When a passthrough request uses transfer direction SG_DXFER_TO_FROM_DEV, bio_copy_user_iov() sets up a temporary iterator iter2 with data_source = ITER_SOURCE to copy user data into the bio pages before execution. bio_copy_from_iter(bio, &iter2) copies the data and advances iter2, but the original iter is never advanced. Consequently, iov_iter_count(&i) remains non-zero in the caller loop in blk_rq_map_user_iov(): i = *iter; do { if (copy) ret = bio_copy_user_iov(rq, map_data, &i, gfp_mask); ... } while (iov_iter_count(&i)); Because i is never advanced, blk_rq_map_user_iov() loops indefinitely, continually allocating bios and consuming map_data pages until it exhausts pages and fails with -EINVAL. Fix this by calling iov_iter_advance(iter, bio->bi_iter.bi_size) in the map_data && map_data->from_user branch after bio_copy_from_iter(). Fixes: 13f3956eb568 ("block: Fix WARNING in _copy_from_iter") Signed-off-by: Terrence Adams Assisted-by: LLM Acked-by: Christian A. Ehrhardt Link: https://patch.msgid.link/20260929160813.1599129-1-tadamsjr@google.com Signed-off-by: Jens Axboe --- block/blk-map.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/blk-map.c b/block/blk-map.c index 81cba3af4e9c..0022710664bc 100644 --- a/block/blk-map.c +++ b/block/blk-map.c @@ -236,6 +236,7 @@ static int bio_copy_user_iov(struct request *rq, struct rq_map_data *map_data, ret = bio_copy_from_iter(bio, &iter2); if (ret) goto cleanup; + iov_iter_advance(iter, bio->bi_iter.bi_size); } else { if (bmd->is_our_pages) zero_fill_bio(bio);