From: Vivek Goyal <vgoyal@redhat.com>
To: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Qian Cai <cai@redhat.com>, Miklos Szeredi <miklos@szeredi.hu>,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
virtio-fs@redhat.com
Subject: Re: virtiofs: WARN_ON(out_sgs + in_sgs != total_sgs)
Date: Tue, 6 Oct 2020 09:06:38 -0400 [thread overview]
Message-ID: <20201006130638.GA5306@redhat.com> (raw)
In-Reply-To: <20201006090427.GA41482@stefanha-x1.localdomain>
On Tue, Oct 06, 2020 at 10:04:27AM +0100, Stefan Hajnoczi wrote:
> On Sun, Oct 04, 2020 at 10:31:19AM -0400, Vivek Goyal wrote:
> > On Fri, Oct 02, 2020 at 10:44:37PM -0400, Qian Cai wrote:
> > > On Fri, 2020-10-02 at 12:28 -0400, Qian Cai wrote:
> > > > Running some fuzzing on virtiofs from a non-privileged user could trigger a
> > > > warning in virtio_fs_enqueue_req():
> > > >
> > > > WARN_ON(out_sgs + in_sgs != total_sgs);
> > >
> > > Okay, I can reproduce this after running for a few hours:
> > >
> > > out_sgs = 3, in_sgs = 2, total_sgs = 6
> >
> > Thanks. I can also reproduce it simply by calling.
> >
> > ioctl(fd, 0x5a004000, buf);
> >
> > I think following WARN_ON() is not correct.
> >
> > WARN_ON(out_sgs + in_sgs != total_sgs)
> >
> > toal_sgs should actually be max sgs. It looks at ap->num_pages and
> > counts one sg for each page. And it assumes that same number of
> > pages will be used both for input and output.
> >
> > But there are no such guarantees. With above ioctl() call, I noticed
> > we are using 2 pages for input (out_sgs) and one page for output (in_sgs).
> >
> > So out_sgs=4, in_sgs=3 and total_sgs=8 and warning triggers.
> >
> > I think total sgs is actually max number of sgs and warning
> > should probably be.
> >
> > WARN_ON(out_sgs + in_sgs > total_sgs)
> >
> > Stefan, WDYT?
>
> It should be possible to calculate total_sgs precisely (not a maximum).
> Treating it as a maximum could hide bugs.
I thought about calculating total_sgs as well. Then became little lazy.
I will redo the patch and then calculate total_sgs precisely.
>
> Maybe sg_count_fuse_req() should count in_args/out_args[numargs -
> 1].size pages instead of adding ap->num_pages.
That should work, I guess. Will try.
Vivek
>
> Do you have the details of struct fuse_req and struct fuse_args_pages
> fields for the ioctl in question?
>
> Thanks,
> Stefan
prev parent reply other threads:[~2020-10-06 13:06 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-02 16:28 virtiofs: WARN_ON(out_sgs + in_sgs != total_sgs) Qian Cai
2020-10-03 2:44 ` Qian Cai
2020-10-04 14:31 ` Vivek Goyal
2020-10-06 9:04 ` Stefan Hajnoczi
2020-10-06 13:06 ` Vivek Goyal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201006130638.GA5306@redhat.com \
--to=vgoyal@redhat.com \
--cc=cai@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=stefanha@redhat.com \
--cc=virtio-fs@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).