From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-fsdevel-owner@vger.kernel.org>
Received: from zeniv.linux.org.uk ([195.92.253.2]:50544 "EHLO
        ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752540AbdGFNSg (ORCPT
        <rfc822;linux-fsdevel@vger.kernel.org>);
        Thu, 6 Jul 2017 09:18:36 -0400
Date: Thu, 6 Jul 2017 14:18:34 +0100
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Andrey Konovalov <andreyknvl@google.com>
Cc: linux-fsdevel@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
        syzkaller <syzkaller@googlegroups.com>,
        Dmitry Vyukov <dvyukov@google.com>,
        Kostya Serebryany <kcc@google.com>,
        Christoph Hellwig <hch@lst.de>
Subject: Re: fs: possible deadlock in do_iter_write/do_splice
Message-ID: <20170706131834.GP10672@ZenIV.linux.org.uk>
References: <CAAeHK+wVSpiHjZ-oUX1Mnw7mnUOBLMYUPuswFegS3C1iocnLQw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAAeHK+wVSpiHjZ-oUX1Mnw7mnUOBLMYUPuswFegS3C1iocnLQw@mail.gmail.com>
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

On Thu, Jul 06, 2017 at 03:01:11PM +0200, Andrey Konovalov wrote:
> Hi,
> 
> I've got the following error report while fuzzing the kernel with syzkaller.
> 
> On commit 9b51f04424e17051a89ab32d892ca66b2a104825 (4.12+).

It's "fs: implement vfs_iter_write using do_iter_write", actually.

vfs_iter_write() has no business playing with file_start_write(); do_iter_write()
does.  

commit 62473a2d6f513296e896b64ccfd7ceb7b963795e
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Thu Jul 6 09:15:47 2017 -0400

    move file_{start,end}_write() out of do_iter_write()
    
    ... and do *not* grab it in vfs_write_iter().
    
    Fixes: "fs: implement vfs_iter_read using do_iter_read"
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/read_write.c b/fs/read_write.c
index acfd3dc63d57..be1125b30aec 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -931,12 +931,10 @@ static ssize_t do_iter_write(struct file *file, struct iov_iter *iter,
 	if (ret < 0)
 		return ret;
 
-	file_start_write(file);
 	if (file->f_op->write_iter)
 		ret = do_iter_readv_writev(file, iter, pos, WRITE, flags);
 	else
 		ret = do_loop_readv_writev(file, iter, pos, WRITE, flags);
-	file_end_write(file);
 	if (ret > 0)
 		fsnotify_modify(file);
 	return ret;
@@ -979,7 +977,9 @@ ssize_t vfs_writev(struct file *file, const struct iovec __user *vec,
 
 	ret = import_iovec(WRITE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
 	if (ret >= 0) {
+		file_start_write(file);
 		ret = do_iter_write(file, &iter, pos, flags);
+		file_end_write(file);
 		kfree(iov);
 	}
 	return ret;
@@ -1247,7 +1247,9 @@ static size_t compat_writev(struct file *file,
 
 	ret = compat_import_iovec(WRITE, vec, vlen, UIO_FASTIOV, &iov, &iter);
 	if (ret >= 0) {
+		file_start_write(file);
 		ret = do_iter_write(file, &iter, pos, flags);
+		file_end_write(file);
 		kfree(iov);
 	}
 	if (ret > 0)