Re: [PATCH] block: flip iter directions in blk_rq_integrity_map_user()

[Jens Axboe]

On 6/3/25 5:49 PM, Keith Busch wrote:
> On Tue, Jun 03, 2025 at 12:54:05PM -0600, Jens Axboe wrote:
>> On 6/3/25 12:47 PM, Caleb Sander Mateos wrote:
>>> blk_rq_integrity_map_user() creates the ubuf iter with ITER_DEST for
>>> write-direction operations and ITER_SOURCE for read-direction ones.
>>> This is backwards; writes use the user buffer as a source for metadata
>>> and reads use it as a destination. Switch to the rq_data_dir() helper,
>>> which maps writes to ITER_SOURCE (WRITE) and reads to ITER_DEST(READ).
>>
>> Was going to ask "how did this ever work without splats", but looks like
>> a fairly recent change AND it's for integrity which isn't widely used.
>> But it does show a gap in testing for sure.
> 
> The change is good and correct, but it doesn't look like normal tests
> would find a problem here. The iter direction in this path only adds the
> FOLL_WRITE flag, which appears to just check for writable access. Unless
> you're specifically testing something using read-only PTE's, a test
> wouldn't have triggered an early error. ?

Ah I missed that - yeah no way we would've spotted this one other than
under really funky configurations/setups.

-- 
Jens Axboe