mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-25 10:19:47 +00:00
fix writev regression: pan hanging unkillable and un-straceable
Frederik Himpe reported an unkillable and un-straceable pan process. Zero length iovecs can go into an infinite loop in writev, because the iovec iterator does not always advance over them. The sequence required to trigger this is not trivial. I think it requires that a zero-length iovec be followed by a non-zero-length iovec which causes a pagefault in the atomic usercopy. This causes the writev code to drop back into single-segment copy mode, which then tries to copy the 0 bytes of the zero-length iovec; a zero length copy looks like a failure though, so it loops. Put a test into iov_iter_advance to catch zero-length iovecs. We could just put the test in the fallback path, but I feel it is more robust to skip over zero-length iovecs throughout the code (iovec iterator may be used in filesystems too, so it should be robust). Signed-off-by: Nick Piggin <npiggin@suse.de> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
6598b60fd5
commit
124d3b7041
1 changed files with 6 additions and 2 deletions
|
@ -1750,7 +1750,11 @@ static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
|
||||||
const struct iovec *iov = i->iov;
|
const struct iovec *iov = i->iov;
|
||||||
size_t base = i->iov_offset;
|
size_t base = i->iov_offset;
|
||||||
|
|
||||||
while (bytes) {
|
/*
|
||||||
|
* The !iov->iov_len check ensures we skip over unlikely
|
||||||
|
* zero-length segments.
|
||||||
|
*/
|
||||||
|
while (bytes || !iov->iov_len) {
|
||||||
int copy = min(bytes, iov->iov_len - base);
|
int copy = min(bytes, iov->iov_len - base);
|
||||||
|
|
||||||
bytes -= copy;
|
bytes -= copy;
|
||||||
|
@ -2268,6 +2272,7 @@ static ssize_t generic_perform_write(struct file *file,
|
||||||
|
|
||||||
cond_resched();
|
cond_resched();
|
||||||
|
|
||||||
|
iov_iter_advance(i, copied);
|
||||||
if (unlikely(copied == 0)) {
|
if (unlikely(copied == 0)) {
|
||||||
/*
|
/*
|
||||||
* If we were unable to copy any data at all, we must
|
* If we were unable to copy any data at all, we must
|
||||||
|
@ -2281,7 +2286,6 @@ static ssize_t generic_perform_write(struct file *file,
|
||||||
iov_iter_single_seg_count(i));
|
iov_iter_single_seg_count(i));
|
||||||
goto again;
|
goto again;
|
||||||
}
|
}
|
||||||
iov_iter_advance(i, copied);
|
|
||||||
pos += copied;
|
pos += copied;
|
||||||
written += copied;
|
written += copied;
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue