pin_user_pages_fast() can partially succeed and return the number of
pages that were actually pinned. However, the bio_integrity_map_user()
does not handle this partial pinning. This leads to a general protection
fault since bvec_from_pages() dereferences an unpinned page address,
which is 0.

To fix this, add a check to verify that all requested memory is pinned.

Reproducer in blktest: https://github.com/linux-blktests/blktests/pull/244

Kernel Oops:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 1061 Comm: nvme-passthroug Not tainted 7.0.0-11783-g90957f9314e8-dirty #16 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
RIP: 0010:bio_integrity_map_user.cold+0x1b0/0x9d6

Fixes: 492c5d455969 ("block: bio-integrity: directly map user buffers")
Acked-by: Chao Shi <cshi008@fiu.edu>
Acked-by: Weidong Zhu <weizhu@fiu.edu>
Acked-by: Dave Tian <daveti@purdue.edu>
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
---
V2: https://lore.kernel.org/linux-block/20260330230256.4160820-2-iam@sung-woo.kim/
V2->V3
- Added a reproducer
- V2 incorrectly assumed pin_user_pages_fast() returns pages.

 block/bio-integrity.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index e79eaf047794..c8cfd15fb589 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -402,6 +402,20 @@ int bio_integrity_map_user(struct bio *bio, struct iov_iter *iter)
 					extraction_flags, &offset);
 	if (unlikely(ret < 0))
 		goto free_bvec;
+	/* Handle partial pinning. This can happen when pin_user_pages_fast()
+	 * returns fewer pages than requested
+	 */
+	if (unlikely(ret != bytes)) {
+		int npinned = DIV_ROUND_UP(offset + ret, PAGE_SIZE);
+		int i;
+
+		for (i = 0; i < npinned; i++)
+			unpin_user_page(pages[i]);
+		if (pages != stack_pages)
+			kvfree(pages);
+		ret = -EFAULT;
+		goto free_bvec;
+	}
 
 	nr_bvecs = bvec_from_pages(bvec, pages, nr_vecs, bytes, offset,
 				   &is_p2p);
-- 
2.47.3

Nit: the subject use the usual block prefix

This is a follow-up based on Sashiko's comments.
https://sashiko.dev/#/patchset/20260420020327.1667156-3-iam%40sung-woo.kim

On Sun, Apr 19, 2026 at 10:05 PM Sungwoo Kim <iam@sung-woo.kim> wrote:
>

[snip]

> diff --git a/block/bio-integrity.c b/block/bio-integrity.c
> index e79eaf047794..c8cfd15fb589 100644
> --- a/block/bio-integrity.c
> +++ b/block/bio-integrity.c
> @@ -402,6 +402,20 @@ int bio_integrity_map_user(struct bio *bio, struct iov_iter *iter)
>                                         extraction_flags, &offset);
>         if (unlikely(ret < 0))
>                 goto free_bvec;

It's pre-existing, though, free_bvec does not kvfree(pages), leading
to a memory leak.

> +       /* Handle partial pinning. This can happen when pin_user_pages_fast()
> +        * returns fewer pages than requested
> +        */
> +       if (unlikely(ret != bytes)) {
> +               int npinned = DIV_ROUND_UP(offset + ret, PAGE_SIZE);

If ret == 0, npinned becomes 1, whereas there is no actually pinned memory

> +               int i;
> +
> +               for (i = 0; i < npinned; i++)
> +                       unpin_user_page(pages[i]);

... which results in invalid access here.

Also, pages[i] can be ITER_KVEC, ITER_BVEC, ITER_FOLIOQ, etc., which
do not pin memory.
Thus, calling unpin_user_page(pages[i]) unconditionally is incorrect.

To fix this, call unpin_user_page() when user_backed_iter(iter) is true.

> +               if (pages != stack_pages)
> +                       kvfree(pages);
> +               ret = -EFAULT;
> +               goto free_bvec;
> +       }
>
>         nr_bvecs = bvec_from_pages(bvec, pages, nr_vecs, bytes, offset,
>                                    &is_p2p);
> --
> 2.47.3
>