Re: [syzbot] [netfs?] KASAN: slab-out-of-bounds Read in iov_iter_revert

[David Howells]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.15-rc6

commit 4f771b49180c404f518c686cdff749ff81f3cc77
Author: David Howells <dhowells@xxxxxxxxxx>
Date:   Fri May 16 23:35:25 2025 +0100

    netfs: Fix oops in write-retry from mis-resetting the subreq iterator

diff --git a/fs/netfs/write_retry.c b/fs/netfs/write_retry.c
index f75e0e8c02cf..9d1d8a8bab72 100644
--- a/fs/netfs/write_retry.c
+++ b/fs/netfs/write_retry.c
@@ -39,9 +39,10 @@ static void netfs_retry_write_stream(struct netfs_io_request *wreq,
 			if (test_bit(NETFS_SREQ_FAILED, &subreq->flags))
 				break;
 			if (__test_and_clear_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
-				struct iov_iter source = subreq->io_iter;
+				struct iov_iter source;
 
-				iov_iter_revert(&source, subreq->len - source.count);
+				netfs_reset_iter(subreq);
+				source = subreq->io_iter;
 				netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
 				netfs_reissue_write(stream, subreq, &source);
 			}