[lvc-project] [PATCH] lib: free pagelist on error in iov_iter_extract_pages()

[Fedor Pchelkin]

On Tue, 12. May 11:12, Dmitry Antipov wrote:
> On Fri, 2026-05-08 at 11:33 -0700, Caleb Sander Mateos wrote:
> 
> > Indeed, it looks like *all* callers of iov_iter_extract_pages()
> > pass a non-NULL struct page **.
> 
> This is not true for 6.12.x at least (where this issue was initially discovered)
> where bio_map_user_iov() do the following:

The current upstream has a caller of iov_iter_extract_pages() in
block/bio-integrity.c where NULL *@pages argument can be passed.

> 
> For 6.12.x and may be other stables, the simplest possible fix is
> https://lore.kernel.org/stable/20260505094529.406783-1-dmantipov@yandex.ru/T/#u.

Older kernels have this pattern inside block/blk-map.c as well which you
fix with the linked patch.  But there's still the same error left in
block/bio-integrity.c in 6.12.x, too.  All the places ideally should be
fixed and this can be done as a couple of patches for 6.12.x.  I'm not
against a step-by-step approach, but think this problem relates to the API
contract and all the cases should be considered as a whole if being
touched anyway.

> 
> For upstream, it may be better to tweak iov_iter_extract_pages() itself, but
> it may be required to adjust all of the callers.

Taken the point that callers seem to be inconsistent about whether they
treat ret < 0 or ret <= 0 as the error case, it's up to them to decide
depending on their own logic.  Not sure if we can suddenly convert all
'< 0' to '<= 0', this doesn't look correct.

And I see now that my initial suggestion to fix the problem in the callees
isn't so sweet and simple as it seemed, and agree with Caleb's and your
initial proposal to adjust the callers' side then.

In that case it'd be good to add some comment to iov_iter_extract_pages()
explaining that the caller is responsible for freeing the allocated memory
if it passes NULL *@pages argument - _even_ if iov_iter_extract_pages()
fails.