From: Qian Cai <cai@redhat.com>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: torvalds@linux-foundation.org, vgoyal@redhat.com,
miklos@szeredi.hu, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: slab-out-of-bounds in iov_iter_revert()
Date: Thu, 17 Sep 2020 16:16:08 -0400 [thread overview]
Message-ID: <2c2d3066f721739050de00293ecdba0b6677ee17.camel@redhat.com> (raw)
In-Reply-To: <20200917184558.GX3421308@ZenIV.linux.org.uk>
On Thu, 2020-09-17 at 19:45 +0100, Al Viro wrote:
> On Thu, Sep 17, 2020 at 01:42:44PM -0400, Qian Cai wrote:
> > > How much IO does it take to trigger that on your reproducer?
> >
> > That is something I don't know for sure because it is always reproducible by
> > running the trinity fuzzer for a few seconds (32 threads). I did another run
> > below (still with your patch applied) and then tried to capture some logs
> > here:
> >
> > http://people.redhat.com/qcai/iov_iter_revert/
>
> FWIW, there were several bugs in that patch:
> * 'shortened' possibly left uninitialized
> * possible error returns with reexpand not done
>
> Could you try this instead?
This works fine. Thanks for taking care of this, Al.
>
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
> ---
> diff --git a/fs/fuse/file.c b/fs/fuse/file.c
> index 6611ef3269a8..43c165e796da 100644
> --- a/fs/fuse/file.c
> +++ b/fs/fuse/file.c
> @@ -3091,11 +3091,10 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter
> *iter)
> ssize_t ret = 0;
> struct file *file = iocb->ki_filp;
> struct fuse_file *ff = file->private_data;
> - bool async_dio = ff->fc->async_dio;
> loff_t pos = 0;
> struct inode *inode;
> loff_t i_size;
> - size_t count = iov_iter_count(iter);
> + size_t count = iov_iter_count(iter), shortened = 0;
> loff_t offset = iocb->ki_pos;
> struct fuse_io_priv *io;
>
> @@ -3103,17 +3102,9 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter
> *iter)
> inode = file->f_mapping->host;
> i_size = i_size_read(inode);
>
> - if ((iov_iter_rw(iter) == READ) && (offset > i_size))
> + if ((iov_iter_rw(iter) == READ) && (offset >= i_size))
> return 0;
>
> - /* optimization for short read */
> - if (async_dio && iov_iter_rw(iter) != WRITE && offset + count > i_size)
> {
> - if (offset >= i_size)
> - return 0;
> - iov_iter_truncate(iter, fuse_round_up(ff->fc, i_size - offset));
> - count = iov_iter_count(iter);
> - }
> -
> io = kmalloc(sizeof(struct fuse_io_priv), GFP_KERNEL);
> if (!io)
> return -ENOMEM;
> @@ -3129,15 +3120,22 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter
> *iter)
> * By default, we want to optimize all I/Os with async request
> * submission to the client filesystem if supported.
> */
> - io->async = async_dio;
> + io->async = ff->fc->async_dio;
> io->iocb = iocb;
> io->blocking = is_sync_kiocb(iocb);
>
> + /* optimization for short read */
> + if (io->async && !io->write && offset + count > i_size) {
> + iov_iter_truncate(iter, fuse_round_up(ff->fc, i_size - offset));
> + shortened = count - iov_iter_count(iter);
> + count -= shortened;
> + }
> +
> /*
> * We cannot asynchronously extend the size of a file.
> * In such case the aio will behave exactly like sync io.
> */
> - if ((offset + count > i_size) && iov_iter_rw(iter) == WRITE)
> + if ((offset + count > i_size) && io->write)
> io->blocking = true;
>
> if (io->async && io->blocking) {
> @@ -3155,6 +3153,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter
> *iter)
> } else {
> ret = __fuse_direct_read(io, iter, &pos);
> }
> + iov_iter_reexpand(iter, iov_iter_count(iter) + shortened);
>
> if (io->async) {
> bool blocking = io->blocking;
>
next prev parent reply other threads:[~2020-09-17 20:17 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-11 21:59 slab-out-of-bounds in iov_iter_revert() Qian Cai
2020-09-11 23:55 ` Al Viro
2020-09-16 21:09 ` Qian Cai
2020-09-17 2:04 ` Al Viro
2020-09-17 2:14 ` Al Viro
2020-09-17 14:10 ` Qian Cai
2020-09-17 16:44 ` Al Viro
2020-09-17 17:42 ` Qian Cai
2020-09-17 18:45 ` Al Viro
2020-09-17 20:16 ` Qian Cai [this message]
2020-09-17 18:45 ` Qian Cai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2c2d3066f721739050de00293ecdba0b6677ee17.camel@redhat.com \
--to=cai@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=torvalds@linux-foundation.org \
--cc=vgoyal@redhat.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).