When a passthrough request uses transfer direction SG_DXFER_TO_FROM_DEV, bio_copy_user_iov() sets up a temporary iterator iter2 with data_source = ITER_SOURCE to copy user data into the bio pages before execution. bio_copy_from_iter(bio, &iter2) copies the data and advances iter2, but the original iter is never advanced. Consequently, iov_iter_count(&i) remains non-zero in the caller loop in blk_rq_map_user_iov(): i = *iter; do { if (copy) ret = bio_copy_user_iov(rq, map_data, &i, gfp_mask); ... } while (iov_iter_count(&i)); Because i is never advanced, blk_rq_map_user_iov() loops indefinitely, continually allocating bios and consuming map_data pages until it exhausts pages and fails with -EINVAL. Fix this by calling iov_iter_advance(iter, bio->bi_iter.bi_size) in the map_data && map_data->from_user branch after bio_copy_from_iter(). Fixes: 13f3956eb568 ("block: Fix WARNING in _copy_from_iter") Signed-off-by: Terrence Adams Assisted-by: LLM --- block/blk-map.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/blk-map.c b/block/blk-map.c index 9cb9605d1f62..2685f6177ceb 100644 --- a/block/blk-map.c +++ b/block/blk-map.c @@ -236,6 +236,7 @@ static int bio_copy_user_iov(struct request *rq, struct rq_map_data *map_data, ret = bio_copy_from_iter(bio, &iter2); if (ret) goto cleanup; + iov_iter_advance(iter, bio->bi_iter.bi_size); } else { if (bmd->is_our_pages) zero_fill_bio(bio); -- 2.56.0.rc1.315.gc6ed9934b7-goog