On Mon, 06 Feb 2023 23:02:52 +0000 David Howells <dhowells@xxxxxxxxxx> > Hi Jens, Christoph, > > I need some help tracking down a bug in the patches that make the bio usin= > g > page pinning or no pinning using iov_iter_extract_pages(). The bug causes > seemingly random memory corruption once the "block: Convert > bio_iov_iter_get_pages to use iov_iter_extract_pages" patch is applied. > > The bug was detected by a syzbot special: > > https://lore.kernel.org/r/000000000000b0b3c005f3a09383@xxxxxxxxxx/ @@ -1342,7 +1342,8 @@ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter) return 0; } - bio_set_flag(bio, BIO_PAGE_REFFED); + if (iov_iter_extract_will_pin(iter)) + bio_set_flag(bio, BIO_PAGE_PINNED); do { ret = __bio_iov_iter_get_pages(bio, iter); } while (!ret && iov_iter_count(iter) && !bio_full(bio, 0)); I suspect it is due to the above change, given the following call trace. pipe_buf_release include/linux/pipe_fs_i.h:183 [inline] iov_iter_revert.part.0+0x402/0x730 lib/iov_iter.c:935 iov_iter_revert+0x4c/0x60 lib/iov_iter.c:919 __iomap_dio_rw+0x16cb/0x1d80 fs/iomap/direct-io.c:610 iomap_dio_rw+0x40/0xa0 fs/iomap/direct-io.c:682 ext4_dio_read_iter fs/ext4/file.c:94 [inline] ext4_file_read_iter+0x4be/0x690 fs/ext4/file.c:145 call_read_iter include/linux/fs.h:1845 [inline] generic_file_splice_read+0x182/0x4b0 fs/splice.c:309 do_splice_to+0x1b9/0x240 fs/splice.c:793 splice_direct_to_actor+0x2ab/0x8a0 fs/splice.c:865 do_splice_direct+0x1ab/0x280 fs/splice.c:974 do_sendfile+0xb19/0x12c0 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x1d0/0x210 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
