From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE01CC433EF for ; Sun, 10 Jul 2022 06:26:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229479AbiGJG0Q (ORCPT ); Sun, 10 Jul 2022 02:26:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60870 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229450AbiGJG0P (ORCPT ); Sun, 10 Jul 2022 02:26:15 -0400 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 0426911C28; Sat, 9 Jul 2022 23:26:14 -0700 (PDT) Received: from sequoia (162-237-133-238.lightspeed.rcsntx.sbcglobal.net [162.237.133.238]) by linux.microsoft.com (Postfix) with ESMTPSA id E0575204CB2B; Sat, 9 Jul 2022 23:26:12 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com E0575204CB2B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1657434373; bh=vRH4An09fv5tOAeTFJW/Mxypr1Ya6mmtln9ASL5X9xI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=BARbJyhxS1Qo4Foxx/iMtbmAHpNs6GISrSvFIA8zhcrjNUl1JKxoyueE3Cclq7Z5n gjV67Arf6iZefe7e4/Mks92ItIgm8IOxGHGkHk7K++8MgQokoRsAVWHCW7Spkei1Uj WL8yC/3PFQ1MR8BMzuDE5enFquKAZw4Gy4PPmxg8= Date: Sun, 10 Jul 2022 01:25:57 -0500 From: Tyler Hicks To: Eric Van Hensbergen , Latchesar Ionkov , Dominique Martinet , Christian Schoenebeck Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , v9fs-developer@lists.sourceforge.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] net/9p: Initialize the iounit field during fid creation Message-ID: <20220710062557.GA272934@sequoia> References: <20220709200005.681861-1-tyhicks@linux.microsoft.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: <20220709200005.681861-1-tyhicks@linux.microsoft.com> Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 2022-07-09 15:00:05, Tyler Hicks wrote: > Ensure that the fid's iounit field is set to zero when a new fid is > created. Certain 9P operations, such as OPEN and CREATE, allow the > server to reply with an iounit size which the client code assigns to the > fid struct shortly after the fid is created in p9_fid_create(). Other > operations that follow a call to p9_fid_create(), such as an XATTRWALK, > don't include an iounit value in the reply message from the server. In > the latter case, the iounit field remained uninitialized. Depending on > allocation patterns, the iounit value could have been something > reasonable that was carried over from previously freed fids or, in the > worst case, could have been arbitrary values from non-fid related usages > of the memory location. >=20 > The bug was detected in the Windows Subsystem for Linux 2 (WSL2) kernel > after the uninitialized iounit field resulted in the typical sequence of > two getxattr(2) syscalls, one to get the size of an xattr and another > after allocating a sufficiently sized buffer to fit the xattr value, to > hit an unexpected ERANGE error in the second call to getxattr(2). An > uninitialized iounit field would sometimes force rsize to be smaller > than the xattr value size in p9_client_read_once() and the 9P server in > WSL refused to chunk up the READ on the attr_fid and, instead, returned > ERANGE to the client. The virtfs server in QEMU seems happy to chunk up > the READ and this problem goes undetected there. However, there are > likely other non-xattr implications of this bug that could cause > inefficient communication between the client and server. >=20 > Cc: stable@vger.kernel.org > Signed-off-by: Tyler Hicks > --- >=20 > Note that I haven't had a chance to identify when this bug was > introduced so I don't yet have a proper Fixes tag. The history looked a > little tricky to me but I'll have another look in the coming days. We > started hitting this bug after trying to move from linux-5.10.y to > linux-5.15.y but I didn't see any obvious changes between those two > series. I'm not confident of this theory but perhaps the fid refcounting > changes impacted the fid allocation patterns enough to uncover the > latent bug? =46rom reading the source, I believe that this first showed up in commit ebf46264a004 ("fs/9p: Add support user. xattr") which landed in v2.6.36. Before that commit, p9_client_read(), p9_client_write(), and p9_client_readdir() were always passed a fid that came from a file's private_data and went through the open/create functions that initialized iounit. That commit was the first that passed a fid directly from p9_fid_create() to p9_client_read(). Tyler