5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

[Zubin Mithra]

Hello,

Syzkaller has triggered a kernel WARNING with the following stacktrace when fuzzing a 4.14 kernel.

Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb7/0x107 lib/dump_stack.c:53
 panic+0x1c9/0x3ae kernel/panic.c:181
 __warn+0x160/0x1a8 kernel/panic.c:543
 report_bug+0x123/0x18b lib/bug.c:186
 fixup_bug+0x3e/0x77 arch/x86/kernel/traps.c:177
 do_error_trap+0xdd/0x1e6 arch/x86/kernel/traps.c:295
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
 do_blockdev_direct_IO+0x1b08/0x1b95 fs/direct-io.c:1373
 ext4_direct_IO_write fs/ext4/inode.c:3696 [inline]
 ext4_direct_IO+0x8de/0xdad fs/ext4/inode.c:3826
 generic_file_direct_write+0x223/0x36b mm/filemap.c:2927
 __generic_file_write_iter+0x12f/0x2f8 mm/filemap.c:3106
 ext4_file_write_iter+0x97d/0xade fs/ext4/file.c:264
 call_write_iter include/linux/fs.h:1782 [inline]
 do_iter_readv_writev+0x1e4/0x27c fs/read_write.c:678
 do_iter_write+0x136/0x18f fs/read_write.c:957
 vfs_iter_write+0x81/0x98 fs/read_write.c:970
 iter_file_splice_write+0x4dc/0x7a6 fs/splice.c:749
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x11e/0x129 fs/splice.c:1018
 splice_direct_to_actor+0x342/0x5b0 fs/splice.c:973
 do_splice_direct+0x180/0x1ff fs/splice.c:1061
 do_sendfile+0x3e6/0x61c fs/read_write.c:1438
 SYSC_sendfile64 fs/read_write.c:1499 [inline]
 SyS_sendfile64+0xe9/0x128 fs/read_write.c:1485
 do_syscall_64+0x203/0x241 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Could the following patch be applied in order to v4.14.y(The patch is present in v4.19.y)?
5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

Tests run:
- Chrome OS tryjobs
- Syzkaller reproducer


Thanks,
- Zubin

Re: 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

[Darrick J. Wong]

On Tue, Apr 23, 2019 at 09:30:22AM -0700, Zubin Mithra wrote:
> Hello,
> 
> Syzkaller has triggered a kernel WARNING with the following stacktrace when fuzzing a 4.14 kernel.
> 
> Call Trace:
>  __dump_stack lib/dump_stack.c:17 [inline]
>  dump_stack+0xb7/0x107 lib/dump_stack.c:53
>  panic+0x1c9/0x3ae kernel/panic.c:181
>  __warn+0x160/0x1a8 kernel/panic.c:543
>  report_bug+0x123/0x18b lib/bug.c:186
>  fixup_bug+0x3e/0x77 arch/x86/kernel/traps.c:177
>  do_error_trap+0xdd/0x1e6 arch/x86/kernel/traps.c:295
>  invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
>  do_blockdev_direct_IO+0x1b08/0x1b95 fs/direct-io.c:1373
>  ext4_direct_IO_write fs/ext4/inode.c:3696 [inline]
>  ext4_direct_IO+0x8de/0xdad fs/ext4/inode.c:3826
>  generic_file_direct_write+0x223/0x36b mm/filemap.c:2927
>  __generic_file_write_iter+0x12f/0x2f8 mm/filemap.c:3106
>  ext4_file_write_iter+0x97d/0xade fs/ext4/file.c:264
>  call_write_iter include/linux/fs.h:1782 [inline]
>  do_iter_readv_writev+0x1e4/0x27c fs/read_write.c:678
>  do_iter_write+0x136/0x18f fs/read_write.c:957
>  vfs_iter_write+0x81/0x98 fs/read_write.c:970
>  iter_file_splice_write+0x4dc/0x7a6 fs/splice.c:749
>  do_splice_from fs/splice.c:851 [inline]
>  direct_splice_actor+0x11e/0x129 fs/splice.c:1018
>  splice_direct_to_actor+0x342/0x5b0 fs/splice.c:973
>  do_splice_direct+0x180/0x1ff fs/splice.c:1061
>  do_sendfile+0x3e6/0x61c fs/read_write.c:1438
>  SYSC_sendfile64 fs/read_write.c:1499 [inline]
>  SyS_sendfile64+0xe9/0x128 fs/read_write.c:1485
>  do_syscall_64+0x203/0x241 arch/x86/entry/common.c:290
>  entry_SYSCALL_64_after_hwframe+0x42/0xb7
> 
> Could the following patch be applied in order to v4.14.y(The patch is present in v4.19.y)?
> 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

That patch only teaches the kernel to emit warnings in dmesg when
programs mix directio and buffered writes.  It doesn't fix any buggy
directio usage.  Someone on the ext4 list [cc'd] might know more about
this.

--D

> 
> Tests run:
> - Chrome OS tryjobs
> - Syzkaller reproducer
> 
> 
> Thanks,
> - Zubin

Re: 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

[Guenter Roeck]

On Tue, Apr 23, 2019 at 10:01 AM Darrick J. Wong
<darrick.wong@oracle.com> wrote:
>
> On Tue, Apr 23, 2019 at 09:30:22AM -0700, Zubin Mithra wrote:
> > Hello,
> >
> > Syzkaller has triggered a kernel WARNING with the following stacktrace when fuzzing a 4.14 kernel.
> >
> > Call Trace:
> >  __dump_stack lib/dump_stack.c:17 [inline]
> >  dump_stack+0xb7/0x107 lib/dump_stack.c:53
> >  panic+0x1c9/0x3ae kernel/panic.c:181
> >  __warn+0x160/0x1a8 kernel/panic.c:543
> >  report_bug+0x123/0x18b lib/bug.c:186
> >  fixup_bug+0x3e/0x77 arch/x86/kernel/traps.c:177
> >  do_error_trap+0xdd/0x1e6 arch/x86/kernel/traps.c:295
> >  invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
> >  do_blockdev_direct_IO+0x1b08/0x1b95 fs/direct-io.c:1373
> >  ext4_direct_IO_write fs/ext4/inode.c:3696 [inline]
> >  ext4_direct_IO+0x8de/0xdad fs/ext4/inode.c:3826
> >  generic_file_direct_write+0x223/0x36b mm/filemap.c:2927
> >  __generic_file_write_iter+0x12f/0x2f8 mm/filemap.c:3106
> >  ext4_file_write_iter+0x97d/0xade fs/ext4/file.c:264
> >  call_write_iter include/linux/fs.h:1782 [inline]
> >  do_iter_readv_writev+0x1e4/0x27c fs/read_write.c:678
> >  do_iter_write+0x136/0x18f fs/read_write.c:957
> >  vfs_iter_write+0x81/0x98 fs/read_write.c:970
> >  iter_file_splice_write+0x4dc/0x7a6 fs/splice.c:749
> >  do_splice_from fs/splice.c:851 [inline]
> >  direct_splice_actor+0x11e/0x129 fs/splice.c:1018
> >  splice_direct_to_actor+0x342/0x5b0 fs/splice.c:973
> >  do_splice_direct+0x180/0x1ff fs/splice.c:1061
> >  do_sendfile+0x3e6/0x61c fs/read_write.c:1438
> >  SYSC_sendfile64 fs/read_write.c:1499 [inline]
> >  SyS_sendfile64+0xe9/0x128 fs/read_write.c:1485
> >  do_syscall_64+0x203/0x241 arch/x86/entry/common.c:290
> >  entry_SYSCALL_64_after_hwframe+0x42/0xb7
> >
> > Could the following patch be applied in order to v4.14.y(The patch is present in v4.19.y)?
> > 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")
>
> That patch only teaches the kernel to emit warnings in dmesg when
> programs mix directio and buffered writes.  It doesn't fix any buggy
> directio usage.  Someone on the ext4 list [cc'd] might know more about
> this.
>

Not sure I understand. Is your argument that systems configured to
panic on warnings should indeed panic if the situation is encountered,
ie that the backtrace and potential panic is warranted ? Isn't this a
potential DOS problem if the situation can be triggered from userspace
on such systems ?

Thanks,
Guenter

> --D
>
> >
> > Tests run:
> > - Chrome OS tryjobs
> > - Syzkaller reproducer
> >
> >
> > Thanks,
> > - Zubin

Re: 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

[Greg KH]

On Tue, Apr 23, 2019 at 09:30:22AM -0700, Zubin Mithra wrote:
> Hello,
> 
> Syzkaller has triggered a kernel WARNING with the following stacktrace when fuzzing a 4.14 kernel.
> 
> Call Trace:
>  __dump_stack lib/dump_stack.c:17 [inline]
>  dump_stack+0xb7/0x107 lib/dump_stack.c:53
>  panic+0x1c9/0x3ae kernel/panic.c:181
>  __warn+0x160/0x1a8 kernel/panic.c:543
>  report_bug+0x123/0x18b lib/bug.c:186
>  fixup_bug+0x3e/0x77 arch/x86/kernel/traps.c:177
>  do_error_trap+0xdd/0x1e6 arch/x86/kernel/traps.c:295
>  invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
>  do_blockdev_direct_IO+0x1b08/0x1b95 fs/direct-io.c:1373
>  ext4_direct_IO_write fs/ext4/inode.c:3696 [inline]
>  ext4_direct_IO+0x8de/0xdad fs/ext4/inode.c:3826
>  generic_file_direct_write+0x223/0x36b mm/filemap.c:2927
>  __generic_file_write_iter+0x12f/0x2f8 mm/filemap.c:3106
>  ext4_file_write_iter+0x97d/0xade fs/ext4/file.c:264
>  call_write_iter include/linux/fs.h:1782 [inline]
>  do_iter_readv_writev+0x1e4/0x27c fs/read_write.c:678
>  do_iter_write+0x136/0x18f fs/read_write.c:957
>  vfs_iter_write+0x81/0x98 fs/read_write.c:970
>  iter_file_splice_write+0x4dc/0x7a6 fs/splice.c:749
>  do_splice_from fs/splice.c:851 [inline]
>  direct_splice_actor+0x11e/0x129 fs/splice.c:1018
>  splice_direct_to_actor+0x342/0x5b0 fs/splice.c:973
>  do_splice_direct+0x180/0x1ff fs/splice.c:1061
>  do_sendfile+0x3e6/0x61c fs/read_write.c:1438
>  SYSC_sendfile64 fs/read_write.c:1499 [inline]
>  SyS_sendfile64+0xe9/0x128 fs/read_write.c:1485
>  do_syscall_64+0x203/0x241 arch/x86/entry/common.c:290
>  entry_SYSCALL_64_after_hwframe+0x42/0xb7
> 
> Could the following patch be applied in order to v4.14.y(The patch is present in v4.19.y)?
> 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

Now queued up, thanks.

greg k-h