[Devel] [PATCH hci-8.1 2/2] fs/fuse kio: check every touched page in iov_iter_sendpages_ok()

[Liu Kui]

A bvec with an unaligned bv_offset can cross into one more page than
sendpages_ok() checks, so fold the intra-page offset into len. Pure
hardening: today the skipped page can never fail sendpage_ok().

https://virtuozzo.atlassian.net/browse/VSTOR-142167

Fixes: 32b44dc7ba67 ("fs/fuse kio: refactor transmit path in pcs_sockio_send()")
Signed-off-by: Liu Kui <kui.liu at virtuozzo.com>
---
 fs/fuse/kio/pcs/pcs_sock_io.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/kio/pcs/pcs_sock_io.c b/fs/fuse/kio/pcs/pcs_sock_io.c
index b4a2ceeb331c..753a85a560bc 100644
--- a/fs/fuse/kio/pcs/pcs_sock_io.c
+++ b/fs/fuse/kio/pcs/pcs_sock_io.c
@@ -272,7 +272,13 @@ static bool iov_iter_sendpages_ok(struct iov_iter *it)
 		return false;
 
 	while (bvec < (it->bvec + it->nr_segs)) {
-		if (!sendpages_ok(bvec->bv_page, bvec->bv_len, bvec->bv_offset))
+		/*
+		 * Fold the intra-page offset into len so sendpages_ok()
+		 * checks every page the range touches.
+		 */
+		if (!sendpages_ok(bvec->bv_page,
+				  (bvec->bv_offset & ~PAGE_MASK) + bvec->bv_len,
+				  bvec->bv_offset & PAGE_MASK))
 			return false;
 		bvec++;
 	}

-- 
Git-155)