Re: [linux-next:master] [netfs] a05b682d49: BUG:KASAN:slab-use-after-free_in_copy_from_iter

[Christian Brauner <brauner@kernel.org>]

On Fri, Sep 13, 2024 at 08:59:19AM GMT, David Howells wrote:
> Can you try with the attached change?  It'll get folded into Christian's
> vfs.netfs branch at some point.

The fix you pasted below is already applied and folded into vfs.netfs.
But what the kernel test robot tested was an old version of that branch.

The commit hash that kernel test robot tested was:

commit: a05b682d498a81ca12f1dd964f06f3aec48af595 ("netfs: Use new folio_queue data type and iterator instead of xarray iter")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master

but in vfs.netfs we have:
cd0277ed0c188dd40e7744e89299af7b78831ca4  ("netfs: Use new folio_queue data type and iterator instead of xarray iter")

and the diff between the two is:

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 84a517a0189d..97003155bfac 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1026,7 +1026,7 @@ static ssize_t iter_folioq_get_pages(struct iov_iter *iter,
                iov_offset += part;
                extracted += part;

-               *pages = folio_page(folio, offset % PAGE_SIZE);
+               *pages = folio_page(folio, offset / PAGE_SIZE);
                get_page(*pages);
                pages++;
                maxpages--;

So this is a bug report for an old version of vfs.netfs.

> 
> David
> ---
> diff --git a/lib/iov_iter.c b/lib/iov_iter.c
> index 84a517a0189d..97003155bfac 100644
> --- a/lib/iov_iter.c
> +++ b/lib/iov_iter.c
> @@ -1026,7 +1026,7 @@ static ssize_t iter_folioq_get_pages(struct iov_iter *iter,
>  		iov_offset += part;
>  		extracted += part;
>  
> -		*pages = folio_page(folio, offset % PAGE_SIZE);
> +		*pages = folio_page(folio, offset / PAGE_SIZE);
>  		get_page(*pages);
>  		pages++;
>  		maxpages--;
>