Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fuse: break infinite loop in fuse_fill_write_pages()
[ Upstream commit 3ca8138 ] I got a report about unkillable task eating CPU. Further investigation shows, that the problem is in the fuse_fill_write_pages() function. If iov's first segment has zero length, we get an infinite loop, because we never reach iov_iter_advance() call. Fix this by calling iov_iter_advance() before repeating an attempt to copy data from userspace. A similar problem is described in 124d3b7 ("fix writev regression: pan hanging unkillable and un-straceable"). If zero-length segmend is followed by segment with invalid address, iov_iter_fault_in_readable() checks only first segment (zero-length), iov_iter_copy_from_user_atomic() skips it, fails at second and returns zero -> goto again without skipping zero-length segment. Patch calls iov_iter_advance() before goto again: we'll skip zero-length segment at second iteraction and iov_iter_fault_in_readable() will detect invalid address. Special thanks to Konstantin Khlebnikov, who helped a lot with the commit description. Cc: Andrew Morton <[email protected]> Cc: Maxim Patlasov <[email protected]> Cc: Konstantin Khlebnikov <[email protected]> Signed-off-by: Roman Gushchin <[email protected]> Signed-off-by: Miklos Szeredi <[email protected]> Fixes: ea9b990 ("fuse: implement perform_write") Cc: <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
- Loading branch information