From: Al Viro <viro@zeniv.linux.org.uk>
To: Qian Cai <cai@redhat.com>
Cc: torvalds@linux-foundation.org, vgoyal@redhat.com,
miklos@szeredi.hu, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: slab-out-of-bounds in iov_iter_revert()
Date: Thu, 17 Sep 2020 03:04:40 +0100 [thread overview]
Message-ID: <20200917020440.GQ3421308@ZenIV.linux.org.uk> (raw)
In-Reply-To: <87ded87d232d9cf87c9c64495bf9190be0e0b6e8.camel@redhat.com>
On Wed, Sep 16, 2020 at 05:09:49PM -0400, Qian Cai wrote:
> On Sat, 2020-09-12 at 00:55 +0100, Al Viro wrote:
> > On Fri, Sep 11, 2020 at 05:59:04PM -0400, Qian Cai wrote:
> > > Super easy to reproduce on today's mainline by just fuzzing for a few
> > > minutes
> > > on virtiofs (if it ever matters). Any thoughts?
> >
> > Usually happens when ->direct_IO() fucks up and reports the wrong amount
> > of data written/read. We had several bugs like that in the past - see
> > e.g. 85128b2be673 (fix nfs O_DIRECT advancing iov_iter too much).
> >
> > Had there been any recent O_DIRECT-related patches on the filesystems
> > involved?
>
> This is only reproducible using FUSE/virtiofs so far, so I will stare at
> fuse_direct_IO() until someone can beat me to it.
What happens there is that it tries to play with iov_iter_truncate() in
->direct_IO() without a corresponding iov_iter_reexpand(). Could you
check if the following helps?
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 6611ef3269a8..d3eec2e11975 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -3095,7 +3095,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
loff_t pos = 0;
struct inode *inode;
loff_t i_size;
- size_t count = iov_iter_count(iter);
+ size_t count = iov_iter_count(iter), shortened;
loff_t offset = iocb->ki_pos;
struct fuse_io_priv *io;
@@ -3111,7 +3111,8 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
if (offset >= i_size)
return 0;
iov_iter_truncate(iter, fuse_round_up(ff->fc, i_size - offset));
- count = iov_iter_count(iter);
+ shortened = count - iov_iter_count(iter);
+ count -= shortened;
}
io = kmalloc(sizeof(struct fuse_io_priv), GFP_KERNEL);
@@ -3177,6 +3178,8 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
else if (ret < 0 && offset + count > i_size)
fuse_do_truncate(file);
}
+ if (shortened)
+ iov_iter_reexpand(iter, shortened);
return ret;
}
next prev parent reply other threads:[~2020-09-17 2:04 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-11 21:59 slab-out-of-bounds in iov_iter_revert() Qian Cai
2020-09-11 23:55 ` Al Viro
2020-09-16 21:09 ` Qian Cai
2020-09-17 2:04 ` Al Viro [this message]
2020-09-17 2:14 ` Al Viro
2020-09-17 14:10 ` Qian Cai
2020-09-17 16:44 ` Al Viro
2020-09-17 17:42 ` Qian Cai
2020-09-17 18:45 ` Al Viro
2020-09-17 20:16 ` Qian Cai
2020-09-17 18:45 ` Qian Cai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200917020440.GQ3421308@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=cai@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=torvalds@linux-foundation.org \
--cc=vgoyal@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).