Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1252311

[PATCH 3.13.y-ckt 29/85] blk-mq: fix buffer overflow when reading sysfs file of 'pending'

From Kamal Mostafa <kamal@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.13.y-ckt 29/85] blk-mq: fix buffer overflow when reading sysfs file of 'pending'
Date 2015-10-21 00:50 +0200
Message-ID <qlNTd-O7-51@gated-at.bofh.it> (permalink)
References <qlMNr-7E9-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt28 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ming Lei <ming.lei@canonical.com>

commit 596f5aad2a704b72934e5abec1b1b4114c16f45b upstream.

There may be lots of pending requests so that the buffer of PAGE_SIZE
can't hold them at all.

One typical example is scsi-mq, the queue depth(.can_queue) of
scsi_host and blk-mq is quite big but scsi_device's queue_depth
is a bit small(.cmd_per_lun), then it is quite easy to have lots
of pending requests in hw queue.

This patch fixes the following warning and the related memory
destruction.

[  359.025101] fill_read_buffer: blk_mq_hw_sysfs_show+0x0/0x7d returned bad count^M
[  359.055595] irq event stamp: 15537^M
[  359.055606] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC ^M
[  359.055614] Dumping ftrace buffer:^M
[  359.055660]    (ftrace buffer empty)^M
[  359.055672] Modules linked in: nbd ipv6 kvm_intel kvm serio_raw^M
[  359.055678] CPU: 4 PID: 21631 Comm: stress-ng-sysfs Not tainted 4.2.0-rc5-next-20150805 #434^M
[  359.055679] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011^M
[  359.055682] task: ffff8802161cc000 ti: ffff88021b4a8000 task.ti: ffff88021b4a8000^M
[  359.055693] RIP: 0010:[<ffffffff811541c5>]  [<ffffffff811541c5>] __kmalloc+0xe8/0x152^M

Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 block/blk-mq-sysfs.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index b91ce75..d2102c4 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -141,15 +141,26 @@ static ssize_t blk_mq_sysfs_completed_show(struct blk_mq_ctx *ctx, char *page)
 
 static ssize_t sysfs_list_show(char *page, struct list_head *list, char *msg)
 {
-	char *start_page = page;
 	struct request *rq;
+	int len = snprintf(page, PAGE_SIZE - 1, "%s:\n", msg);
+
+	list_for_each_entry(rq, list, queuelist) {
+		const int rq_len = 2 * sizeof(rq) + 2;
+
+		/* if the output will be truncated */
+		if (PAGE_SIZE - 1 < len + rq_len) {
+			/* backspacing if it can't hold '\t...\n' */
+			if (PAGE_SIZE - 1 < len + 5)
+				len -= rq_len;
+			len += snprintf(page + len, PAGE_SIZE - 1 - len,
+					"\t...\n");
+			break;
+		}
+		len += snprintf(page + len, PAGE_SIZE - 1 - len,
+				"\t%p\n", rq);
+	}
 
-	page += sprintf(page, "%s:\n", msg);
-
-	list_for_each_entry(rq, list, queuelist)
-		page += sprintf(page, "\t%p\n", rq);
-
-	return page - start_page;
+	return len;
 }
 
 static ssize_t blk_mq_sysfs_rq_list_show(struct blk_mq_ctx *ctx, char *page)
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt28 stable review Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:40 +0200
  [PATCH 3.13.y-ckt 73/85] perf hists: Update the column width for the "srcline" sort key Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
  [PATCH 3.13.y-ckt 84/85] task_work: remove fifo ordering guarantee Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
  [PATCH 3.13.y-ckt 65/85] drm/qxl: validate monitors config modes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
  [PATCH 3.13.y-ckt 85/85] scsi_dh: fix randconfig build error Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
  [PATCH 3.13.y-ckt 82/85] mmc: core: fix race condition in mmc_wait_data_done Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
  [PATCH 3.13.y-ckt 81/85] IB/uverbs: Fix race between ib_uverbs_open and remove_one Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
  [PATCH 3.13.y-ckt 79/85] IB/mlx4: Forbid using sysfs to change RoCE pkeys Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
  [PATCH 3.13.y-ckt 80/85] IB/mlx4: Use correct SL on AH query under RoCE Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
  [PATCH 3.13.y-ckt 83/85] ipv6: fix exthdrs offload registration in out_rt path Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
  [PATCH 3.13.y-ckt 77/85] perf stat: Get correct cpu id for print_aggr Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
  [PATCH 3.13.y-ckt 67/85] x86/mm: Initialize pmd_idx in page_table_range_init_count() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 55/85] Input: evdev - do not report errors form flush() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 48/85] xfs: return errors from partial I/O failures to files Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 75/85] batman-adv: Make NC capability changes atomic Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 69/85] jbd2: avoid infinite loop when destroying aborted journal Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 56/85] crypto: ghash-clmulni: specify context size for ghash async algorithm Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 50/85] tg3: Fix temperature reporting Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 60/85] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 49/85] IB/qib: Change lkey table allocation to support more MRs Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 70/85] clk: versatile: off by one in clk_sp810_timerclken_of_get() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 74/85] batman-adv: Make DAT capability changes atomic Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 41/85] Btrfs: check if previous transaction aborted to avoid fs corruption Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 71/85] usb: gadget: m66592-udc: forever loop in set_feature() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 78/85] IB/mlx4: Fix potential deadlock when sending mad to wire Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 57/85] fs: create and use seq_show_option for escaping Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 58/85] ALSA: hda - Enable headphone jack detect on old Fujitsu laptops Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 53/85] IB/uverbs: reject invalid or unknown opcodes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 61/85] parisc: Use double word condition in 64bit CAS operation Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 76/85] powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 51/85] drm/i915: Always mark the object as dirty when used by the GPU Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 54/85] hpfs: update ctime and mtime on directory modification Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 46/85] drivercore: Fix unregistration path of platform devices Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 68/85] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 47/85] Input: synaptics - fix handling of disabling gesture mode Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
    Re: [PATCH 3.13.y-ckt 47/85] Input: synaptics - fix handling of  disabling gesture mode Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2015-10-21 00:50 +0200
      Re: [PATCH 3.13.y-ckt 47/85] Input: synaptics - fix handling of  disabling gesture mode Kamal Mostafa <kamal@canonical.com> - 2015-10-21 22:30 +0200
  [PATCH 3.13.y-ckt 43/85] rtlwifi: rtl8192cu: Add new device ID Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 21/85] iio: event: Remove negative error code from iio_event_poll Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 72/85] windfarm: decrement client count when unregistering Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 22/85] NFSv4: don't set SETATTR for O_RDONLY|O_EXCL Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 52/85] Add radeon suspend/resume quirk for HP Compaq dc5750. Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 59/85] ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
  [PATCH 3.13.y-ckt 35/85] USB: ftdi_sio: Added custom PID for CustomWare products Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 30/85] xtensa: fix kernel register spilling Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 26/85] drivers: usb: fsl: Workaround for USB erratum-A005275 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 36/85] HID: usbhid: Fix the check for HID_RESET_PENDING in hid_io_error Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 17/85] iio: adis16400: Fix adis16448 gyroscope scale Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 38/85] libxfs: readahead of dir3 data blocks should use the read verifier Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 18/85] iio: Add inverse unit conversion macros Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 37/85] eCryptfs: Invalidate dcache entries when lower i_nlink is zero Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 31/85] NFS: nfs_set_pgio_error sometimes misses errors Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 44/85] rtlwifi: rtl8192cu: Add new device ID Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 45/85] of/address: Don't loop forever in of_find_matching_node_by_address(). Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 28/85] staging: comedi: adl_pci7x3x: fix digital output on PCI-7230 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 39/85] xfs: Fix xfs_attr_leafblock definition Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 27/85] serial: 8250: don't bind to SMSC IrCC IR port Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 34/85] USB: symbolserial: Use usb_get_serial_port_data Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 32/85] NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 client Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 29/85] blk-mq: fix buffer overflow when reading sysfs file of 'pending' Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 42/85] DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 33/85] usb: host: ehci-sys: delete useless bus_to_hcd conversion Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 40/85] arm64: kconfig: Move LIST_POISON to a safe value Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 02/85] dcache: Handle escaped paths in prepend_path Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
  [PATCH 3.13.y-ckt 07/85] xtensa: fix threadptr reload on return to userspace Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 03/85] vfs: Test for and handle paths that are unreachable from their mnt_root Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 05/85] [media] v4l: omap3isp: Fix sub-device power management code Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 16/85] devres: fix devres_get() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 08/85] ARM: OMAP2+: DRA7: clockdomain: change l4per2_7xx_clkdm to SW_WKUP Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 04/85] sctp: fix race on protocol/netns initialization Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 12/85] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 14/85] KVM: MMU: fix validation of mmio page fault Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 11/85] PCI: Add VPD function 0 quirk for Intel Ethernet devices Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 10/85] PCI: Add dev_flags bit to access VPD through function 0 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 15/85] auxdisplay: ks0108: fix refcount Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 09/85] mac80211: enable assoc check for mesh interfaces Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
  [PATCH 3.13.y-ckt 13/85] serial: 8250_pci: Add support for Pericom PI7C9X795[1248] Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200

csiph-web