From: David Howells <dhowells@redhat.com>
To: viro@ZenIV.linux.org.uk
Cc: Marc Dionne <marc.dionne@auristor.com>,
dhowells@redhat.com, linux-fsdevel@vger.kernel.org,
linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: [PATCH 15/27] afs: Fix AFS read bug
Date: Thu, 09 Mar 2017 18:57:32 +0000 [thread overview]
Message-ID: <148908585213.16794.6509270739973493830.stgit@warthog.procyon.org.uk> (raw)
In-Reply-To: <148908574888.16794.14109877851518811944.stgit@warthog.procyon.org.uk>
Fix a bug in AFS read whereby the request page afs_read::index isn't
incremented after calling ->page_done() if ->remain reaches 0, indicating
that the data read is complete.
Without this a NULL pointer exception happens when ->page_done() is called
twice for the last page because the page clearing loop will call it also
and afs_readpages_page_done() clears the current entry in the page list.
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: afs_readpages_page_done+0x21/0xa4 [kafs]
PGD 0
Oops: 0002 [#1] SMP
Modules linked in: kafs(E)
CPU: 2 PID: 3002 Comm: md5sum Tainted: G E 4.10.0-fscache #485
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
task: ffff8804017d86c0 task.stack: ffff8803fc1d8000
RIP: 0010:afs_readpages_page_done+0x21/0xa4 [kafs]
RSP: 0018:ffff8803fc1db978 EFLAGS: 00010282
RAX: ffff880405d39af8 RBX: 0000000000000000 RCX: ffff880407d83ed4
RDX: 0000000000000000 RSI: ffff880405d39a00 RDI: ffff880405c6f400
RBP: ffff8803fc1db988 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8803fc1db820 R11: ffff88040cf56000 R12: ffff8804088f1780
R13: ffff8804017d86c0 R14: ffff8804088f1780 R15: 0000000000003840
FS: 00007f8154469700(0000) GS:ffff88041fb00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000004016ec000 CR4: 00000000001406e0
Call Trace:
afs_deliver_fs_fetch_data+0x5b9/0x60e [kafs]
? afs_make_call+0x316/0x4e8 [kafs]
? afs_make_call+0x359/0x4e8 [kafs]
afs_deliver_to_call+0x173/0x2e8 [kafs]
? afs_make_call+0x316/0x4e8 [kafs]
afs_make_call+0x37a/0x4e8 [kafs]
? wake_up_q+0x4f/0x4f
? __init_waitqueue_head+0x36/0x49
afs_fs_fetch_data+0x21c/0x227 [kafs]
? afs_fs_fetch_data+0x21c/0x227 [kafs]
afs_vnode_fetch_data+0xf3/0x1d2 [kafs]
afs_readpages+0x314/0x3fd [kafs]
__do_page_cache_readahead+0x208/0x2c5
ondemand_readahead+0x3a2/0x3b7
? ondemand_readahead+0x3a2/0x3b7
page_cache_async_readahead+0x5e/0x67
generic_file_read_iter+0x23b/0x70c
? __inode_security_revalidate+0x2f/0x62
__vfs_read+0xc4/0xe8
vfs_read+0xd1/0x15a
SyS_read+0x4c/0x89
do_syscall_64+0x80/0x191
entry_SYSCALL64_slow_path+0x25/0x25
Reported-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Marc Dionne <marc.dionne@auristor.com>
---
fs/afs/fsclient.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index c05452a09398..4314f9e63a2c 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -390,9 +390,9 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
if (call->offset == PAGE_SIZE) {
if (req->page_done)
req->page_done(call, req);
+ req->index++;
if (req->remain > 0) {
call->offset = 0;
- req->index++;
if (req->index >= req->nr_pages) {
call->unmarshall = 4;
goto begin_discard;
next prev parent reply other threads:[~2017-03-09 18:57 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-09 18:55 [PATCH 01/27] afs: Fix missing put_page() David Howells
2017-03-09 18:55 ` [PATCH 02/27] afs: Fix page overput in afs_fill_page() David Howells
2017-03-09 18:56 ` [PATCH 03/27] afs: Populate group ID from vnode status David Howells
2017-03-09 18:56 ` [PATCH 04/27] afs: Adjust mode bits processing David Howells
2017-03-09 18:56 ` [PATCH 05/27] afs: Deal with an empty callback array David Howells
2017-03-09 18:56 ` [PATCH 06/27] afs: Handle better the server returning excess or short data David Howells
2017-03-09 18:56 ` [PATCH 07/27] afs: Kill struct afs_read::pg_offset David Howells
2017-03-09 18:56 ` [PATCH 08/27] afs: Handle a short write to an AFS page David Howells
2017-03-09 18:56 ` [PATCH 09/27] afs: Flush outstanding writes when an fd is closed David Howells
2017-03-09 18:56 ` [PATCH 10/27] afs: Distinguish mountpoints from symlinks by file mode alone David Howells
2017-03-09 18:57 ` [PATCH 11/27] afs: inode: Replace rcu_assign_pointer() with RCU_INIT_POINTER() David Howells
2017-03-09 18:57 ` [PATCH 12/27] afs: security: " David Howells
2017-03-09 18:57 ` [PATCH 13/27] afs: Migrate vlocation fields to 64-bit David Howells
2017-03-09 18:57 ` [PATCH 14/27] afs: Prevent callback expiry timer overflow David Howells
2017-03-09 18:57 ` David Howells [this message]
2017-03-09 18:57 ` [PATCH 16/27] afs: Make struct afs_read::remain 64-bit David Howells
2017-03-09 18:57 ` [PATCH 17/27] afs: Use a bvec rather than a kvec in afs_send_pages() David Howells
2017-03-09 18:57 ` [PATCH 18/27] afs: Fix the maths in afs_fs_store_data() David Howells
2017-03-09 18:58 ` [PATCH 19/27] afs: Invalid op ID should abort with RXGEN_OPCODE David Howells
2017-03-09 18:58 ` [PATCH 20/27] afs: Better abort and net error handling David Howells
2017-03-09 18:58 ` [PATCH 21/27] afs: Populate and use client modification time David Howells
2017-03-09 18:58 ` [PATCH 22/27] afs: Don't set PG_error on local EINTR or ENOMEM when filling a page David Howells
2017-03-09 18:58 ` [PATCH 23/27] afs: Fix page leak in afs_write_begin() David Howells
2017-03-09 18:58 ` [PATCH 24/27] afs: afs_fsync() does two flushes, one of which is redundant David Howells
2017-03-09 18:58 ` [PATCH 25/27] afs: Fix afs_kill_pages() David Howells
2017-03-09 18:58 ` [PATCH 26/27] afs: Fix an off-by-one error in afs_send_pages() David Howells
2017-03-09 18:58 ` [PATCH 27/27] afs: Fix abort on signal while waiting for call completion David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=148908585213.16794.6509270739973493830.stgit@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=linux-afs@lists.infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marc.dionne@auristor.com \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).