Re: [PATCH AUTOSEL 5.15 21/27] fs: fix an infinite loop in iomap_fiemap

From: Amir Goldstein <amir73il@gmail.com>
To: Sasha Levin <sashal@kernel.org>
Cc: stable <stable@vger.kernel.org>,
	Guo Xuenan <guoxuenan@huawei.com>, Hulk Robot <hulkci@huawei.com>,
	Christoph Hellwig <hch@lst.de>,
	"Darrick J . Wong" <djwong@kernel.org>,
	Al Viro <viro@zeniv.linux.org.uk>,
	linux-fsdevel <linux-fsdevel@vger.kernel.org>,
	"Luis R. Rodriguez" <mcgrof@kernel.org>
Subject: Re: [PATCH AUTOSEL 5.15 21/27] fs: fix an infinite loop in iomap_fiemap
Date: Thu, 7 Apr 2022 14:30:33 +0300	[thread overview]
Message-ID: <CAOQ4uxg2c+MtCaA6+how4WOP3a3EAYfR1Rzz-PB9fxX411t3+Q@mail.gmail.com> (raw)
In-Reply-To: <CAOQ4uxi+Z_YDga+fkcuOjwo5EKfRkhsCp4SwxMHK0ARdJ_-+Aw@mail.gmail.com>

On Thu, Apr 7, 2022 at 2:28 PM Amir Goldstein <amir73il@gmail.com> wrote:
>
> On Thu, Apr 7, 2022 at 7:26 AM Sasha Levin <sashal@kernel.org> wrote:
> >
> > From: Guo Xuenan <guoxuenan@huawei.com>
> >
> > [ Upstream commit 49df34221804cfd6384135b28b03c9461a31d024 ]
> >
> > when get fiemap starting from MAX_LFS_FILESIZE, (maxbytes - *len) < start
> > will always true , then *len set zero. because of start offset is beyond
> > file size, for erofs filesystem it will always return iomap.length with
> > zero,iomap iterate will enter infinite loop. it is necessary cover this
> > corner case to avoid this situation.
> >
> > ------------[ cut here ]------------
> > WARNING: CPU: 7 PID: 905 at fs/iomap/iter.c:35 iomap_iter+0x97f/0xc70
> > Modules linked in: xfs erofs
> > CPU: 7 PID: 905 Comm: iomap Tainted: G        W         5.17.0-rc8 #27
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> > RIP: 0010:iomap_iter+0x97f/0xc70
> > Code: 85 a1 fc ff ff e8 71 be 9c ff 0f 1f 44 00 00 e9 92 fc ff ff e8 62 be 9c ff 0f 0b b8 fb ff ff ff e9 fc f8 ff ff e8 51 be 9c ff <0f> 0b e9 2b fc ff ff e8 45 be 9c ff 0f 0b e9 e1 fb ff ff e8 39 be
> > RSP: 0018:ffff888060a37ab0 EFLAGS: 00010293
> > RAX: 0000000000000000 RBX: ffff888060a37bb0 RCX: 0000000000000000
> > RDX: ffff88807e19a900 RSI: ffffffff81a7da7f RDI: ffff888060a37be0
> > RBP: 7fffffffffffffff R08: 0000000000000000 R09: ffff888060a37c20
> > R10: ffff888060a37c67 R11: ffffed100c146f8c R12: 7fffffffffffffff
> > R13: 0000000000000000 R14: ffff888060a37bd8 R15: ffff888060a37c20
> > FS:  00007fd3cca01540(0000) GS:ffff888108780000(0000) knlGS:0000000000000000
> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000000020010820 CR3: 0000000054b92000 CR4: 00000000000006e0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > Call Trace:
> >  <TASK>
> >  iomap_fiemap+0x1c9/0x2f0
> >  erofs_fiemap+0x64/0x90 [erofs]
> >  do_vfs_ioctl+0x40d/0x12e0
> >  __x64_sys_ioctl+0xaa/0x1c0
> >  do_syscall_64+0x35/0x80
> >  entry_SYSCALL_64_after_hwframe+0x44/0xae
> >  </TASK>
> > ---[ end trace 0000000000000000 ]---
> > watchdog: BUG: soft lockup - CPU#7 stuck for 26s! [iomap:905]
> >
> > Reported-by: Hulk Robot <hulkci@huawei.com>
> > Signed-off-by: Guo Xuenan <guoxuenan@huawei.com>
> > Reviewed-by: Christoph Hellwig <hch@lst.de>
> > [djwong: fix some typos]
> > Reviewed-by: Darrick J. Wong <djwong@kernel.org>
> > Signed-off-by: Darrick J. Wong <djwong@kernel.org>
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> >  fs/ioctl.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/fs/ioctl.c b/fs/ioctl.c
> > index 504e69578112..e0a3455f9a0f 100644
> > --- a/fs/ioctl.c
> > +++ b/fs/ioctl.c
> > @@ -173,7 +173,7 @@ int fiemap_prep(struct inode *inode, struct fiemap_extent_info *fieinfo,
> >
> >         if (*len == 0)
> >                 return -EINVAL;
> > -       if (start > maxbytes)
> > +       if (start >= maxbytes)
> >                 return -EFBIG;
> >
> >         /*
> > --
> > 2.35.1
> >
>
> Sasha,
>
> Any reason why I didn't see this patch posted for 5.10.y?
> I happen to know that it applies cleanly to 5.10.109 and I also included it in
> my xfs-5.10.y patch candidates branch [1] which has gone through some
> xfstests cycles already.
>

Nevermind, I see it was just posted :)

Thanks,
Amir.

>
> [1] https://github.com/amir73il/linux/commits/xfs-5.10.y