lkml.org 
[lkml]   [2017]   [Jul]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: fs: possible deadlock in do_iter_write/do_splice
On Thu, Jul 06, 2017 at 03:01:11PM +0200, Andrey Konovalov wrote:
> Hi,
>
> I've got the following error report while fuzzing the kernel with syzkaller.
>
> On commit 9b51f04424e17051a89ab32d892ca66b2a104825 (4.12+).

It's "fs: implement vfs_iter_write using do_iter_write", actually.

vfs_iter_write() has no business playing with file_start_write(); do_iter_write()
does.

commit 62473a2d6f513296e896b64ccfd7ceb7b963795e
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu Jul 6 09:15:47 2017 -0400

move file_{start,end}_write() out of do_iter_write()

... and do *not* grab it in vfs_write_iter().

Fixes: "fs: implement vfs_iter_read using do_iter_read"
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/read_write.c b/fs/read_write.c
index acfd3dc63d57..be1125b30aec 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -931,12 +931,10 @@ static ssize_t do_iter_write(struct file *file, struct iov_iter *iter,
if (ret < 0)
return ret;

- file_start_write(file);
if (file->f_op->write_iter)
ret = do_iter_readv_writev(file, iter, pos, WRITE, flags);
else
ret = do_loop_readv_writev(file, iter, pos, WRITE, flags);
- file_end_write(file);
if (ret > 0)
fsnotify_modify(file);
return ret;
@@ -979,7 +977,9 @@ ssize_t vfs_writev(struct file *file, const struct iovec __user *vec,

ret = import_iovec(WRITE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
if (ret >= 0) {
+ file_start_write(file);
ret = do_iter_write(file, &iter, pos, flags);
+ file_end_write(file);
kfree(iov);
}
return ret;
@@ -1247,7 +1247,9 @@ static size_t compat_writev(struct file *file,

ret = compat_import_iovec(WRITE, vec, vlen, UIO_FASTIOV, &iov, &iter);
if (ret >= 0) {
+ file_start_write(file);
ret = do_iter_write(file, &iter, pos, flags);
+ file_end_write(file);
kfree(iov);
}
if (ret > 0)
\
 
 \ /
  Last update: 2017-07-06 15:19    [W:0.041 / U:38.724 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site