All of lore.kernel.org
 help / color / mirror / Atom feed
From: David Howells <dhowells@redhat.com>
To: viro@ZenIV.linux.org.uk
Cc: Marc Dionne <marc.dionne@auristor.com>,
	dhowells@redhat.com, linux-fsdevel@vger.kernel.org,
	linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: [PATCH 15/27] afs: Fix AFS read bug
Date: Thu, 09 Mar 2017 18:57:32 +0000	[thread overview]
Message-ID: <148908585213.16794.6509270739973493830.stgit@warthog.procyon.org.uk> (raw)
In-Reply-To: <148908574888.16794.14109877851518811944.stgit@warthog.procyon.org.uk>

Fix a bug in AFS read whereby the request page afs_read::index isn't
incremented after calling ->page_done() if ->remain reaches 0, indicating
that the data read is complete.

Without this a NULL pointer exception happens when ->page_done() is called
twice for the last page because the page clearing loop will call it also
and afs_readpages_page_done() clears the current entry in the page list.

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: afs_readpages_page_done+0x21/0xa4 [kafs]
PGD 0
Oops: 0002 [#1] SMP
Modules linked in: kafs(E)
CPU: 2 PID: 3002 Comm: md5sum Tainted: G            E   4.10.0-fscache #485
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
task: ffff8804017d86c0 task.stack: ffff8803fc1d8000
RIP: 0010:afs_readpages_page_done+0x21/0xa4 [kafs]
RSP: 0018:ffff8803fc1db978 EFLAGS: 00010282
RAX: ffff880405d39af8 RBX: 0000000000000000 RCX: ffff880407d83ed4
RDX: 0000000000000000 RSI: ffff880405d39a00 RDI: ffff880405c6f400
RBP: ffff8803fc1db988 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8803fc1db820 R11: ffff88040cf56000 R12: ffff8804088f1780
R13: ffff8804017d86c0 R14: ffff8804088f1780 R15: 0000000000003840
FS:  00007f8154469700(0000) GS:ffff88041fb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000004016ec000 CR4: 00000000001406e0
Call Trace:
 afs_deliver_fs_fetch_data+0x5b9/0x60e [kafs]
 ? afs_make_call+0x316/0x4e8 [kafs]
 ? afs_make_call+0x359/0x4e8 [kafs]
 afs_deliver_to_call+0x173/0x2e8 [kafs]
 ? afs_make_call+0x316/0x4e8 [kafs]
 afs_make_call+0x37a/0x4e8 [kafs]
 ? wake_up_q+0x4f/0x4f
 ? __init_waitqueue_head+0x36/0x49
 afs_fs_fetch_data+0x21c/0x227 [kafs]
 ? afs_fs_fetch_data+0x21c/0x227 [kafs]
 afs_vnode_fetch_data+0xf3/0x1d2 [kafs]
 afs_readpages+0x314/0x3fd [kafs]
 __do_page_cache_readahead+0x208/0x2c5
 ondemand_readahead+0x3a2/0x3b7
 ? ondemand_readahead+0x3a2/0x3b7
 page_cache_async_readahead+0x5e/0x67
 generic_file_read_iter+0x23b/0x70c
 ? __inode_security_revalidate+0x2f/0x62
 __vfs_read+0xc4/0xe8
 vfs_read+0xd1/0x15a
 SyS_read+0x4c/0x89
 do_syscall_64+0x80/0x191
 entry_SYSCALL64_slow_path+0x25/0x25

Reported-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Marc Dionne <marc.dionne@auristor.com>
---

 fs/afs/fsclient.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index c05452a09398..4314f9e63a2c 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -390,9 +390,9 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
 		if (call->offset == PAGE_SIZE) {
 			if (req->page_done)
 				req->page_done(call, req);
+			req->index++;
 			if (req->remain > 0) {
 				call->offset = 0;
-				req->index++;
 				if (req->index >= req->nr_pages) {
 					call->unmarshall = 4;
 					goto begin_discard;

  parent reply	other threads:[~2017-03-09 18:57 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-03-09 18:55 [PATCH 01/27] afs: Fix missing put_page() David Howells
2017-03-09 18:55 ` [PATCH 02/27] afs: Fix page overput in afs_fill_page() David Howells
2017-03-09 18:56 ` [PATCH 03/27] afs: Populate group ID from vnode status David Howells
2017-03-09 18:56 ` [PATCH 04/27] afs: Adjust mode bits processing David Howells
2017-03-09 18:56 ` [PATCH 05/27] afs: Deal with an empty callback array David Howells
2017-03-09 18:56 ` [PATCH 06/27] afs: Handle better the server returning excess or short data David Howells
2017-03-09 18:56 ` [PATCH 07/27] afs: Kill struct afs_read::pg_offset David Howells
2017-03-09 18:56 ` [PATCH 08/27] afs: Handle a short write to an AFS page David Howells
2017-03-09 18:56 ` [PATCH 09/27] afs: Flush outstanding writes when an fd is closed David Howells
2017-03-09 18:56 ` [PATCH 10/27] afs: Distinguish mountpoints from symlinks by file mode alone David Howells
2017-03-09 18:57 ` [PATCH 11/27] afs: inode: Replace rcu_assign_pointer() with RCU_INIT_POINTER() David Howells
2017-03-09 18:57 ` [PATCH 12/27] afs: security: " David Howells
2017-03-09 18:57 ` [PATCH 13/27] afs: Migrate vlocation fields to 64-bit David Howells
2017-03-09 18:57 ` [PATCH 14/27] afs: Prevent callback expiry timer overflow David Howells
2017-03-09 18:57 ` David Howells [this message]
2017-03-09 18:57 ` [PATCH 16/27] afs: Make struct afs_read::remain 64-bit David Howells
2017-03-09 18:57 ` [PATCH 17/27] afs: Use a bvec rather than a kvec in afs_send_pages() David Howells
2017-03-09 18:57 ` [PATCH 18/27] afs: Fix the maths in afs_fs_store_data() David Howells
2017-03-09 18:58 ` [PATCH 19/27] afs: Invalid op ID should abort with RXGEN_OPCODE David Howells
2017-03-09 18:58 ` [PATCH 20/27] afs: Better abort and net error handling David Howells
2017-03-09 18:58 ` [PATCH 21/27] afs: Populate and use client modification time David Howells
2017-03-09 18:58 ` [PATCH 22/27] afs: Don't set PG_error on local EINTR or ENOMEM when filling a page David Howells
2017-03-09 18:58 ` [PATCH 23/27] afs: Fix page leak in afs_write_begin() David Howells
2017-03-09 18:58 ` [PATCH 24/27] afs: afs_fsync() does two flushes, one of which is redundant David Howells
2017-03-09 18:58 ` [PATCH 25/27] afs: Fix afs_kill_pages() David Howells
2017-03-09 18:58 ` [PATCH 26/27] afs: Fix an off-by-one error in afs_send_pages() David Howells
2017-03-09 18:58 ` [PATCH 27/27] afs: Fix abort on signal while waiting for call completion David Howells

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=148908585213.16794.6509270739973493830.stgit@warthog.procyon.org.uk \
    --to=dhowells@redhat.com \
    --cc=linux-afs@lists.infradead.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marc.dionne@auristor.com \
    --cc=viro@ZenIV.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.