)]}'
{
  "commit": "a290a9e5cf5fbba05d6c59b94b36d00f4fc15ef2",
  "tree": "b4abc877d09db63f52991fdf0f478e558ab312ed",
  "parents": [
    "19b18e01d0361ce495be153ecce80b581086ab3f"
  ],
  "author": {
    "name": "Chris Mason",
    "email": "mason@kernel.org",
    "time": "Thu Oct 29 15:00:22 2026 +0100"
  },
  "committer": {
    "name": "Christian Brauner",
    "email": "brauner@kernel.org",
    "time": "Fri Oct 30 13:40:41 2026 +0100"
  },
  "message": "iov_iter: fix NULL deref in iov_iter_alignment()\n\nSince commit 111a12b422a8 (\"io_uring/rsrc: reject zero-length fixed\nbuffer import\") io_import_fixed() hands out an empty ITER_BVEC for a\nzero-length request. Its count is 0 and its bvec array is NULL.\n\niov_iter_alignment() only checks the count for ITER_UBUF. For ITER_BVEC\nit calls iov_iter_alignment_bvec() and the do-while loop in there reads\nbvec-\u003ebv_len before it looks at the count. So it dereferences NULL.\n\nbtrfs checks the alignment of a direct read with iov_iter_alignment()\nbefore it looks at the count and f2fs does the same. So any user that\ncan open a file on btrfs can oops the kernel with a single zero-length\nIORING_OP_READ_FIXED on an O_DIRECT file descriptor. With IOSQE_ASYNC\nthe oops happens in an io-wq worker. The dead worker stays on the worker\nlist and when the task that submitted the request exits io-wq writes to\nthe freed task_struct of the worker. That\u0027s just fallout from the oops\nthough.\n\nEmpty iterators with a NULL array aren\u0027t unusual. afs, tls and tipc\ncreate them as well. So leave io_uring alone and make\niov_iter_alignment() return 0 for an empty iterator of any type.\n\nFixes: 111a12b422a8 (\"io_uring/rsrc: reject zero-length fixed buffer import\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\nLink: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-3-88f22792f6f7@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2072c04e99d052c00dc0cae69e76e2064d9fa704",
      "old_mode": 33188,
      "old_path": "lib/iov_iter.c",
      "new_id": "56c59a2b589d384e3c0ee987c5866cd540284986",
      "new_mode": 33188,
      "new_path": "lib/iov_iter.c"
    }
  ]
}