From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751090AbbJBT2E (ORCPT ); Fri, 2 Oct 2015 15:28:04 -0400 Received: from mx2.parallels.com ([199.115.105.18]:46266 "EHLO mx2.parallels.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750844AbbJBT2C (ORCPT ); Fri, 2 Oct 2015 15:28:02 -0400 Subject: Re: [fuse-devel] [PATCH] fuse: break infinite loop in fuse_fill_write_pages() To: Konstantin Khlebnikov , Roman Gushchin References: <1442829773-14150-1-git-send-email-klamm@yandex-team.ru> CC: , Andrew Morton , Linux Kernel Mailing List , Al Viro , Miklos Szeredi From: Maxim Patlasov Message-ID: <560EDAB1.5090605@parallels.com> Date: Fri, 2 Oct 2015 12:27:45 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Transfer-Encoding: 7bit X-ClientProxiedBy: US-EXCH.sw.swsoft.com (10.255.249.47) To US-EXCH.sw.swsoft.com (10.255.249.47) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/02/2015 04:21 AM, Konstantin Khlebnikov wrote: > Bump. Add more peopple in CC. > > On Mon, Sep 21, 2015 at 1:02 PM, Roman Gushchin wrote: >> I got a report about unkillable task eating CPU. Thge further >> investigation shows, that the problem is in the fuse_fill_write_pages() >> function. If iov's first segment has zero length, we get an infinite >> loop, because we never reach iov_iter_advance() call. iov_iter_copy_from_user_atomic() eventually calls iterate_iovec(). The latter silently consumes zero-length iov. So I don't think "iov's first segment has zero length" can cause infinite loop. Thanks, Maxim >> >> Fix this by calling iov_iter_advance() before repeating an attempt to >> copy data from userspace. >> >> A similar problem is described in 124d3b7041f ("fix writev regression: >> pan hanging unkillable and un-straceable"). >> >> Signed-off-by: Roman Gushchin >> Cc: Miklos Szeredi >> --- >> fs/fuse/file.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/fs/fuse/file.c b/fs/fuse/file.c >> index f523f2f..195476a 100644 >> --- a/fs/fuse/file.c >> +++ b/fs/fuse/file.c >> @@ -1049,6 +1049,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req, >> tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes); >> flush_dcache_page(page); >> >> + iov_iter_advance(ii, tmp); >> if (!tmp) { >> unlock_page(page); >> page_cache_release(page); >> @@ -1061,7 +1062,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req, >> req->page_descs[req->num_pages].length = tmp; >> req->num_pages++; >> >> - iov_iter_advance(ii, tmp); >> count += tmp; >> pos += tmp; >> offset += tmp; >> -- >> 2.4.3 >> >> -- >> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in >> the body of a message to majordomo@vger.kernel.org >> More majordomo info at http://vger.kernel.org/majordomo-info.html >> Please read the FAQ at http://www.tux.org/lkml/ > ------------------------------------------------------------------------------ > _______________________________________________ > fuse-devel mailing list > fuse-devel@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/fuse-devel