lkml.org 
[lkml]   [2016]   [Sep]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[bug] pwritev02 hang on s390x with 4.8.0-rc7
Date
Hi,

I'm hitting a regression with LTP's pwritev02 [1] on s390x with 4.8.0-rc7.
Specifically the EFAULT case, which is passing an iovec with invalid base address:
#define CHUNK 64
static struct iovec wr_iovec3[] = {
{(char *)-1, CHUNK},
};
hangs with 100% cpu usage and not very helpful stack trace:
# cat /proc/28544/stack
[<0000000000001000>] 0x1000
[<ffffffffffffffff>] 0xffffffffffffffff

The problem starts with d4690f1e1cda "fix iov_iter_fault_in_readable()".

Before this commit fault_in_pages_readable() called __get_user() on start
address which presumably failed with -EFAULT immediately.

With this commit applied fault_in_multipages_readable() appears to return 0
for the case when "start" is invalid but "end" overflows. Then according to
my traces we keep spinning inside while loop in iomap_write_actor().

Patch below makes the issue go away for me:

diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 66a1260b33de..e443dbd2b5df 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -600,11 +600,11 @@ static inline int fault_in_multipages_readable(const char __user *uaddr,
int size)
{
volatile char c;
- int ret = 0;
+ int ret = -EFAULT;
const char __user *end = uaddr + size - 1;

if (unlikely(size == 0))
- return ret;
+ return 0;

while (uaddr <= end) {
ret = __get_user(c, uaddr);
Regards,
Jan

[1] https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/pwritev/pwritev02.c

\
 
 \ /
  Last update: 2016-09-20 14:56    [W:0.196 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site