From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74C64C433DB for ; Sun, 21 Feb 2021 00:48:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2D5A364EEC for ; Sun, 21 Feb 2021 00:48:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229879AbhBUAqs (ORCPT ); Sat, 20 Feb 2021 19:46:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57368 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229811AbhBUAqk (ORCPT ); Sat, 20 Feb 2021 19:46:40 -0500 Received: from mail-lj1-x233.google.com (mail-lj1-x233.google.com [IPv6:2a00:1450:4864:20::233]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EF080C061574 for ; Sat, 20 Feb 2021 16:45:59 -0800 (PST) Received: by mail-lj1-x233.google.com with SMTP id u4so44386848ljh.6 for ; Sat, 20 Feb 2021 16:45:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZH9LxqmdK4WuGCkSanDTOuYEMBk6Ae5+wTyCpsy2cQ0=; b=KH3Zy4AmYAnSUiR8Z0SlgMZdokgu/97Q1tbAKHOQ/3KCSD8MC2z00FJLXqx8XpPPN+ wwbs+442hga5jO/x2Z2lOibpainN4le+ACi2knTBFTwbsqOMEjx0MQpIgBJlMYb/pZXu tH8rjYArrknBZHuCOEEnxQslWyWdKN+Q3RFPs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZH9LxqmdK4WuGCkSanDTOuYEMBk6Ae5+wTyCpsy2cQ0=; b=AN8a+TYX58pkTiy/Ye/+QkSbvy+IKI8/5JmLz+XZYVqSuCS0vPehlgYfU7BnZ0aij4 Ev74zBBWWuREUKMcDFMw3YOH59Ir5NaXeviKZ9w3QMmcJ64WuoEWt+4gM/uVoJehYOTG fqVxDF058Wqp48Qx+3pjMaXRJbdM3sKd6CKcDn6KYmOuDdc3xCgZtGMtnFmEKbffq7BS pwLA4X+rFJkZPaXrRAB9Ybj93V2raqi9vkGKfN94lU836Nxa7UsB4UIM8+Varp2kFPve sZnLK/z/4hrQRAh6IQxqvLCips8ZzJQSqwx76iAILcRCN6CCl4N2DFqmC1MA238w6dAg +C9w== X-Gm-Message-State: AOAM5329IvCLzYAG6xLjGug8R2ixZjvG7FIrGW8Xi/63KOS6B28C4DTf /Pi+C2Ao9UvHjuUXxlXJgiIkmBs+uwq3lA== X-Google-Smtp-Source: ABdhPJw4ExKyEBBwwkKewJCB/H0iLA2O90Dvd+SpmMWhFT7D527q8lyTUTgEuAfSIn3tH4E/iPmz5A== X-Received: by 2002:a05:6512:519:: with SMTP id o25mr9819709lfb.529.1613868357772; Sat, 20 Feb 2021 16:45:57 -0800 (PST) Received: from mail-lj1-f173.google.com (mail-lj1-f173.google.com. [209.85.208.173]) by smtp.gmail.com with ESMTPSA id k9sm1474766ljg.59.2021.02.20.16.45.56 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 20 Feb 2021 16:45:57 -0800 (PST) Received: by mail-lj1-f173.google.com with SMTP id c17so44460341ljn.0 for ; Sat, 20 Feb 2021 16:45:56 -0800 (PST) X-Received: by 2002:a2e:3910:: with SMTP id g16mr9773864lja.61.1613868356421; Sat, 20 Feb 2021 16:45:56 -0800 (PST) MIME-Version: 1.0 References: <0000000000001fb73f05bb767334@google.com> <0000000000000ca18b05bbc556d6@google.com> In-Reply-To: From: Linus Torvalds Date: Sat, 20 Feb 2021 16:45:40 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: WARNING in iov_iter_revert (2) To: Al Viro Cc: syzbot , Greg Kroah-Hartman , Jiri Slaby , Linux Kernel Mailing List , snovitoll@gmail.com, syzkaller-bugs Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ Let's see how long this lasts, but I've got a generator for the laptop, and hopefully I'll be able to start doing pulls tonight, and get "real" power tomorrow ] On Sat, Feb 20, 2021 at 11:30 AM Al Viro wrote: > > IOW, it's not iov_iter_revert() being weird or do_tty_write() misuing it - > it's tpk_write() playing silly buggers. Ok, that's actually not as bad I was was afraid it might be. > Do we want to preserve that weirdness of /dev/ttyprintk writes? > That's orthogonal to the iov_iter uses in there. I don't think the ttyprintk weirdness was intentional. I'd fix that, but in the meantime clearly we should make do_tty_write() protect against this insanity, and do something like --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -961,6 +961,9 @@ static inline ssize_t do_tty_write( ret = write(tty, file, tty->write_buf, size); if (ret <= 0) break; + /* ttyprintk historical oddity */ + if (ret > size) + break; /* FIXME! Have Al check this! */ if (ret != size) in there. Because right now we clearly do strange and not-so-wonderful things if the write routine returns a bigger value than it was passed.. Not limited to that iov_iter_revert() thing, but the whole loop. Comments? Linus