Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1341484
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.14 50/70] fuse: break infinite loop in fuse_fill_write_pages() |
| Date | 2016-02-24 06:00 +0100 |
| Message-ID | <r5zIn-7K8-33@gated-at.bofh.it> (permalink) |
| References | <r5yVY-7pJ-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Gushchin <klamm@yandex-team.ru>
commit 3ca8138f014a913f98e6ef40e939868e1e9ea876 upstream.
I got a report about unkillable task eating CPU. Further
investigation shows, that the problem is in the fuse_fill_write_pages()
function. If iov's first segment has zero length, we get an infinite
loop, because we never reach iov_iter_advance() call.
Fix this by calling iov_iter_advance() before repeating an attempt to
copy data from userspace.
A similar problem is described in 124d3b7041f ("fix writev regression:
pan hanging unkillable and un-straceable"). If zero-length segmend
is followed by segment with invalid address,
iov_iter_fault_in_readable() checks only first segment (zero-length),
iov_iter_copy_from_user_atomic() skips it, fails at second and
returns zero -> goto again without skipping zero-length segment.
Patch calls iov_iter_advance() before goto again: we'll skip zero-length
segment at second iteraction and iov_iter_fault_in_readable() will detect
invalid address.
Special thanks to Konstantin Khlebnikov, who helped a lot with the commit
description.
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Maxim Patlasov <mpatlasov@parallels.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Roman Gushchin <klamm@yandex-team.ru>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Fixes: ea9b9907b82a ("fuse: implement perform_write")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1006,6 +1006,7 @@ static ssize_t fuse_fill_write_pages(str
tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
flush_dcache_page(page);
+ iov_iter_advance(ii, tmp);
if (!tmp) {
unlock_page(page);
page_cache_release(page);
@@ -1018,7 +1019,6 @@ static ssize_t fuse_fill_write_pages(str
req->page_descs[req->num_pages].length = tmp;
req->num_pages++;
- iov_iter_advance(ii, tmp);
count += tmp;
pos += tmp;
offset += tmp;
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.14 00/70] 3.14.62-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 36/70] iio: fix some warning messages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 59/70] m32r: fix m32104ut_defconfig build fail Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 64/70] radix-tree: fix race in gang lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 39/70] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 04/70] phy: twl4030-usb: Relase usb phy on unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 50/70] fuse: break infinite loop in fuse_fill_write_pages() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 40/70] cifs: fix erroneous return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 05/70] wan/x25: Fix use-after-free in x25_asy_open_tty() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 15/70] perf trace: Fix documentation for -i Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 57/70] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 67/70] intel_scu_ipcutil: underflow in scu_reg_access() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 49/70] KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 63/70] memcg: only free spare array when readers are done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 58/70] xhci: Fix list corruption in urb dequeue at host removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 66/70] dump_stack: avoid potential deadlocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 41/70] nfs: Fix race in __update_open_stateid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 06/70] staging/speakup: Use tty_ldisc_ref() for paste kworker Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 70/70] module: wrapper for symbol name. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 43/70] udf: Prevent buffer overrun with multi-byte characters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 44/70] udf: Check output buffer length when converting name to CS0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 10/70] AIO: properly check iovec sizes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 37/70] iio: adis_buffer: Fix out-of-bounds memory access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 03/70] ALSA: seq: Fix double port list deletion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 34/70] iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 24/70] SCSI: Fix NULL pointer dereference in runtime PM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 29/70] scsi_dh_rdac: always retry MODE SELECT on command lock violation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 31/70] scsi: fix soft lockup in scsi_remove_target() on module removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 23/70] Fix a memory leak in scsi_host_dev_release() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 30/70] SCSI: Add Marvell Console to VPD blacklist Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 28/70] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 13/70] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 27/70] SCSI: fix crashes in sd and sr runtime PM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 35/70] iio: ad5064: Fix ad5629/ad5669 shift Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 25/70] Revert "SCSI: Fix NULL pointer dereference in runtime PM" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 32/70] iio:ad7793: Fix ad7785 product ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 26/70] iscsi-target: Fix potential dead-lock during node acl delete Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 38/70] iio: dac: mcp4725: set iio name property in sysfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 11/70] ext4: fix potential integer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 33/70] iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 22/70] iscsi-target: Fix rx_login_comp hang after login failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:20 +0100 [PATCH 3.14 02/70] drm/i915: get runtime PM reference around GEM set_caching IOCTL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 19/70] klist: fix starting point removed bug in klist iterators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 18/70] tracing: Fix freak link error caused by branch tracer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 16/70] ptrace: use fsuid, fsgid, effective creds for fs access checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 20/70] scsi: restart list search after unlock in scsi_remove_target Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 17/70] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 21/70] scsi_sysfs: Fix queue_ramp_up_period return code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 Re: [PATCH 3.14 00/70] 3.14.62-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-24 19:30 +0100 Re: [PATCH 3.14 00/70] 3.14.62-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-25 07:00 +0100
csiph-web