Fairly old DIO bug caught by Andreas (3.10+) and several slightly younger blk_rq_map_user_iov() bugs, both on map and copy codepaths (Vitaly and me). The following changes since commit 8a5776a5f49812d29fe4b2d0a2d71675c3facf3f: Linux 4.14-rc4 (2017-10-08 20:53:29 -0700) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus for you to fetch changes up to 1cfd0ddd82232804e03f3023f6a58b50dfef0574: bio_copy_user_iov(): don't ignore ->iov_offset (2017-10-10 23:55:14 -0400) ---------------------------------------------------------------- Al Viro (2): more bio_map_user_iov() leak fixes bio_copy_user_iov(): don't ignore ->iov_offset Andreas Gruenbacher (1): direct-io: Prevent NULL pointer access in submit_page_section Vitaly Mayatskikh (1): fix unbalanced page refcounting in bio_map_user_iov block/bio.c | 26 +++++++++++++++++++------- fs/direct-io.c | 3 ++- 2 files changed, 21 insertions(+), 8 deletions(-)