Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1341393

[PATCH 3.10 36/54] fuse: break infinite loop in fuse_fill_write_pages()

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Roman Gushchin <klamm@yandex-team.ru>

commit 3ca8138f014a913f98e6ef40e939868e1e9ea876 upstream.

I got a report about unkillable task eating CPU. Further
investigation shows, that the problem is in the fuse_fill_write_pages()
function. If iov's first segment has zero length, we get an infinite
loop, because we never reach iov_iter_advance() call.

Fix this by calling iov_iter_advance() before repeating an attempt to
copy data from userspace.

A similar problem is described in 124d3b7041f ("fix writev regression:
pan hanging unkillable and un-straceable"). If zero-length segmend
is followed by segment with invalid address,
iov_iter_fault_in_readable() checks only first segment (zero-length),
iov_iter_copy_from_user_atomic() skips it, fails at second and
returns zero -> goto again without skipping zero-length segment.

Patch calls iov_iter_advance() before goto again: we'll skip zero-length
segment at second iteraction and iov_iter_fault_in_readable() will detect
invalid address.

Special thanks to Konstantin Khlebnikov, who helped a lot with the commit
description.

Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Maxim Patlasov <mpatlasov@parallels.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Roman Gushchin <klamm@yandex-team.ru>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Fixes: ea9b9907b82a ("fuse: implement perform_write")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/fuse/file.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -993,6 +993,7 @@ static ssize_t fuse_fill_write_pages(str
 
 		mark_page_accessed(page);
 
+		iov_iter_advance(ii, tmp);
 		if (!tmp) {
 			unlock_page(page);
 			page_cache_release(page);
@@ -1005,7 +1006,6 @@ static ssize_t fuse_fill_write_pages(str
 		req->page_descs[req->num_pages].length = tmp;
 		req->num_pages++;
 
-		iov_iter_advance(ii, tmp);
 		count += tmp;
 		pos += tmp;
 		offset += tmp;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/54] 3.10.98-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:00 +0100
  [PATCH 3.10 31/54] udf: limit the maximum number of indirect extents in a row Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 32/54] udf: Prevent buffer overrun with multi-byte characters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 27/54] iio: adis_buffer: Fix out-of-bounds memory access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 05/54] pty: make sure super_block is still valid in final /dev/tty close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 19/54] iscsi-target: Fix potential dead-lock during node acl delete Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 04/54] pty: fix possible use after free of tty->driver_data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 24/54] iio:ad7793: Fix ad7785 product ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 23/54] scsi: fix soft lockup in scsi_remove_target() on module removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 25/54] iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 30/54] nfs: Fix race in __update_open_stateid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 12/54] tracing: Fix freak link error caused by branch tracer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 26/54] iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:10 +0100
  [PATCH 3.10 53/54] ip6mr: call del_timer_sync() in ip6mr_free_table() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:30 +0100
  [PATCH 3.10 54/54] module: wrapper for symbol name. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:30 +0100
  [PATCH 3.10 36/54] fuse: break infinite loop in fuse_fill_write_pages() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 05:30 +0100
  [PATCH 3.10 41/54] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
  [PATCH 3.10 38/54] Input: elantech - add Fujitsu Lifebook U745 to force crc_enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
  [PATCH 3.10 33/54] udf: Check output buffer length when converting name to CS0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
  [PATCH 3.10 42/54] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
  [PATCH 3.10 39/54] Input: elantech - mark protocols v2 and v3 as semi-mt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
  [PATCH 3.10 37/54] mm: soft-offline: check return value in second __get_any_page() call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
  [PATCH 3.10 17/54] Fix a memory leak in scsi_host_dev_release() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  [PATCH 3.10 02/54] wan/x25: Fix use-after-free in x25_asy_open_tty() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  [PATCH 3.10 14/54] scsi: restart list search after unlock in scsi_remove_target Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  [PATCH 3.10 11/54] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  [PATCH 3.10 01/54] ALSA: seq: Fix double port list deletion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  [PATCH 3.10 16/54] iscsi-target: Fix rx_login_comp hang after login failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  [PATCH 3.10 18/54] SCSI: Fix NULL pointer dereference in runtime PM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  [PATCH 3.10 15/54] scsi_sysfs: Fix queue_ramp_up_period return code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  [PATCH 3.10 13/54] klist: fix starting point removed bug in klist iterators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  [PATCH 3.10 10/54] ptrace: use fsuid, fsgid, effective creds for fs access checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  [PATCH 3.10 20/54] SCSI: fix crashes in sd and sr runtime PM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
  Re: [PATCH 3.10 00/54] 3.10.98-stable review Willy Tarreau <w@1wt.eu> - 2016-02-24 17:40 +0100
    Re: [PATCH 3.10 00/54] 3.10.98-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-25 20:10 +0100
  Re: [PATCH 3.10 00/54] 3.10.98-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-24 19:30 +0100
  Re: [PATCH 3.10 00/54] 3.10.98-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-25 06:00 +0100
    Re: [PATCH 3.10 00/54] 3.10.98-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-25 17:50 +0100
      Re: [PATCH 3.10 00/54] 3.10.98-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-25 18:10 +0100

csiph-web