Bug introduced in 3b93f911d5

Bug introduced in 3b93f911d5

[Anton Altaparmakov]

Hi Al,

Was just looking at __generic_file_write_iter() and found a bug in the code that you added in 3b93f911d5.

Consider the case where generic_file_direct_write() returns a partial write, i.e. written > 0 && written < count.

Also consider that the following generic_perform_write() fails with an error, i.e. status < 0.

This code then does something very bogus:

		if (unlikely(status < 0) && !written) {
			err = status;
			goto out;
		}
		iocb->ki_pos = pos + status;
		...
		endbyte = pos + status - 1;

The if condition is false as written is > 0 yet status is negative thus iocb->ki_pos is set to pos + status where status is negative thus ki_pos is actually set to "pos - random value".

And similar for "endbyte" being set to "pos - random value - 1", etc.

Doesn't seem like that is what you intended?

Best regards,

	Anton
-- 
Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @)
University of Cambridge Information Services, Roger Needham Building
7 JJ Thomson Avenue, Cambridge, CB3 0RB, UK

Re: Bug introduced in 3b93f911d5

[Al Viro]

On Fri, Aug 08, 2014 at 12:11:39AM +0100, Anton Altaparmakov wrote:
> Hi Al,
> 
> Was just looking at __generic_file_write_iter() and found a bug in the code that you added in 3b93f911d5.
> 
> Consider the case where generic_file_direct_write() returns a partial write, i.e. written > 0 && written < count.
> 
> Also consider that the following generic_perform_write() fails with an error, i.e. status < 0.

*nod*

What we ought to do, AFAICS, is this:

diff --git a/mm/filemap.c b/mm/filemap.c
index 900edfa..8163e04 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2584,7 +2584,7 @@ ssize_t __generic_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
 		 * that this differs from normal direct-io semantics, which
 		 * will return -EFOO even if some bytes were written.
 		 */
-		if (unlikely(status < 0) && !written) {
+		if (unlikely(status < 0)) {
 			err = status;
 			goto out;
 		}

Note that we return written ? written : err, so assignment to err will be
the right thing both when status < 0 && written == 0 and when status < 0 &&
written > 0.  In the latter case err will be simply ignored.

Objections?

Re: Bug introduced in 3b93f911d5

[Anton Altaparmakov]

Hi Al,

On 8 Aug 2014, at 16:54, Al Viro <viro@zeniv.linux.org.uk> wrote:
> On Fri, Aug 08, 2014 at 12:11:39AM +0100, Anton Altaparmakov wrote:
>> Hi Al,
>> 
>> Was just looking at __generic_file_write_iter() and found a bug in the code that you added in 3b93f911d5.
>> 
>> Consider the case where generic_file_direct_write() returns a partial write, i.e. written > 0 && written < count.
>> 
>> Also consider that the following generic_perform_write() fails with an error, i.e. status < 0.
> 
> *nod*
> 
> What we ought to do, AFAICS, is this:
> 
> diff --git a/mm/filemap.c b/mm/filemap.c
> index 900edfa..8163e04 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -2584,7 +2584,7 @@ ssize_t __generic_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
> 		 * that this differs from normal direct-io semantics, which
> 		 * will return -EFOO even if some bytes were written.
> 		 */
> -		if (unlikely(status < 0) && !written) {
> +		if (unlikely(status < 0)) {
> 			err = status;
> 			goto out;
> 		}
> 
> Note that we return written ? written : err, so assignment to err will be
> the right thing both when status < 0 && written == 0 and when status < 0 &&
> written > 0.  In the latter case err will be simply ignored.
> 
> Objections?

No objections from me.  As you say, that will do the right thing in all cases.

Best regards,

	Anton
-- 
Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @)
University of Cambridge Information Services, Roger Needham Building
7 JJ Thomson Avenue, Cambridge, CB3 0RB, UK