Merge tag 'block-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - Fix the start and length check added to iov_iter_extract_bvecs(),
   which used iter_iov_addr()/iter_iov_len() helpers that aren't safe
   for the ITER_BVEC/FOLIOQ/etc iterator types passed

 - sunvdc fixes for an -EIO issue from lack of retries, and unmapping
   LDC cookies when the descriptor send fails

 - Clear force_abort in ublk_queue_reset_io_flags()

 - ublk selftest install fix

* tag 'block-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  selftests: ublk: add batch IO cases to recover_03
  ublk: clear force_abort in ublk_queue_reset_io_flags()
  sunvdc: fix -EIO issue due to lack of retries
  sunvdc: unmap LDC cookies when the descriptor send fails
  block: Fix start and length check added to iov_iter_extract_bvecs()
  selftests: ublk: install test_common.sh and trace/ scripts

1 files changed, 16 insertions, 2 deletions

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 6665372ecf71..2072c04e99d0 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1921,15 +1921,29 @@ ssize_t iov_iter_extract_bvecs(struct iov_iter *iter, struct bio_vec *bv,
 		unsigned short max_vecs, unsigned mem_align_mask,
 		iov_iter_extraction_t extraction_flags)
 {
-	unsigned long start = (unsigned long)iter_iov_addr(iter);
 	unsigned short entries_left = max_vecs - *nr_vecs;
 	unsigned short nr_pages, i = 0;
 	size_t left, offset, len;
 	struct page **pages;
 	ssize_t size;
 
-	if ((start | iter_iov_len(iter)) & mem_align_mask)
+	/*
+	 * DMA engines typically have both memory address and length alignment
+	 * requirements, so check these against the alignment mask.  For UBUF,
+	 * IOVEC and KVEC, only the current segment will be extracted from; for
+	 * everything else we might extract from multiple segments, so we need
+	 * to check those too.
+	 */
+	if (likely(iter_is_ubuf(iter) ||
+		   iter_is_iovec(iter) ||
+		   iov_iter_is_kvec(iter))) {
+		unsigned long start = (unsigned long)iter_iov_addr(iter);
+
+		if ((start | iter_iov_len(iter)) & mem_align_mask)
+			return -EINVAL;
+	} else if (iov_iter_alignment(iter) & mem_align_mask) {
 		return -EINVAL;
+	}
 
 	/*
 	 * Move page array up in the allocated memory for the bio vecs as far as