lkml.org 
[lkml]   [2015]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.1 003/159] blk-mq: fix buffer overflow when reading sysfs file of pending
    Date
    4.1-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ming Lei <ming.lei@canonical.com>

    commit 596f5aad2a704b72934e5abec1b1b4114c16f45b upstream.

    There may be lots of pending requests so that the buffer of PAGE_SIZE
    can't hold them at all.

    One typical example is scsi-mq, the queue depth(.can_queue) of
    scsi_host and blk-mq is quite big but scsi_device's queue_depth
    is a bit small(.cmd_per_lun), then it is quite easy to have lots
    of pending requests in hw queue.

    This patch fixes the following warning and the related memory
    destruction.

    [ 359.025101] fill_read_buffer: blk_mq_hw_sysfs_show+0x0/0x7d returned bad count^M
    [ 359.055595] irq event stamp: 15537^M
    [ 359.055606] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC ^M
    [ 359.055614] Dumping ftrace buffer:^M
    [ 359.055660] (ftrace buffer empty)^M
    [ 359.055672] Modules linked in: nbd ipv6 kvm_intel kvm serio_raw^M
    [ 359.055678] CPU: 4 PID: 21631 Comm: stress-ng-sysfs Not tainted 4.2.0-rc5-next-20150805 #434^M
    [ 359.055679] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011^M
    [ 359.055682] task: ffff8802161cc000 ti: ffff88021b4a8000 task.ti: ffff88021b4a8000^M
    [ 359.055693] RIP: 0010:[<ffffffff811541c5>] [<ffffffff811541c5>] __kmalloc+0xe8/0x152^M

    Signed-off-by: Ming Lei <ming.lei@canonical.com>
    Signed-off-by: Jens Axboe <axboe@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    block/blk-mq-sysfs.c | 21 ++++++++++++++++-----
    1 file changed, 16 insertions(+), 5 deletions(-)

    --- a/block/blk-mq-sysfs.c
    +++ b/block/blk-mq-sysfs.c
    @@ -141,15 +141,26 @@ static ssize_t blk_mq_sysfs_completed_sh

    static ssize_t sysfs_list_show(char *page, struct list_head *list, char *msg)
    {
    - char *start_page = page;
    struct request *rq;
    + int len = snprintf(page, PAGE_SIZE - 1, "%s:\n", msg);

    - page += sprintf(page, "%s:\n", msg);
    + list_for_each_entry(rq, list, queuelist) {
    + const int rq_len = 2 * sizeof(rq) + 2;

    - list_for_each_entry(rq, list, queuelist)
    - page += sprintf(page, "\t%p\n", rq);
    + /* if the output will be truncated */
    + if (PAGE_SIZE - 1 < len + rq_len) {
    + /* backspacing if it can't hold '\t...\n' */
    + if (PAGE_SIZE - 1 < len + 5)
    + len -= rq_len;
    + len += snprintf(page + len, PAGE_SIZE - 1 - len,
    + "\t...\n");
    + break;
    + }
    + len += snprintf(page + len, PAGE_SIZE - 1 - len,
    + "\t%p\n", rq);
    + }

    - return page - start_page;
    + return len;
    }

    static ssize_t blk_mq_sysfs_rq_list_show(struct blk_mq_ctx *ctx, char *page)



    \
     
     \ /
      Last update: 2015-09-27 00:01    [W:4.321 / U:1.656 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site