| From f658adeea45e430a24c7a157c3d5448925ac2038 Mon Sep 17 00:00:00 2001 |
| From: Miklos Szeredi <mszeredi@redhat.com> |
| Date: Thu, 6 Feb 2020 16:39:28 +0100 |
| Subject: fix up iter on short count in fuse_direct_io() |
| |
| From: Miklos Szeredi <mszeredi@redhat.com> |
| |
| commit f658adeea45e430a24c7a157c3d5448925ac2038 upstream. |
| |
| fuse_direct_io() can end up advancing the iterator by more than the amount |
| of data read or written. This case is handled by the generic code if going |
| through ->direct_IO(), but not in the FOPEN_DIRECT_IO case. |
| |
| Fix by reverting the extra bytes from the iterator in case of error or a |
| short count. |
| |
| To test: install lxcfs, then the following testcase |
| int fd = open("/var/lib/lxcfs/proc/uptime", O_RDONLY); |
| sendfile(1, fd, NULL, 16777216); |
| sendfile(1, fd, NULL, 16777216); |
| will spew WARN_ON() in iov_iter_pipe(). |
| |
| Reported-by: Peter Geis <pgwipeout@gmail.com> |
| Reported-by: Al Viro <viro@zeniv.linux.org.uk> |
| Fixes: 3c3db095b68c ("fuse: use iov_iter based generic splice helpers") |
| Cc: <stable@vger.kernel.org> # v5.1 |
| Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| fs/fuse/file.c | 5 ++++- |
| 1 file changed, 4 insertions(+), 1 deletion(-) |
| |
| --- a/fs/fuse/file.c |
| +++ b/fs/fuse/file.c |
| @@ -1465,6 +1465,7 @@ ssize_t fuse_direct_io(struct fuse_io_pr |
| } |
| ia = NULL; |
| if (nres < 0) { |
| + iov_iter_revert(iter, nbytes); |
| err = nres; |
| break; |
| } |
| @@ -1473,8 +1474,10 @@ ssize_t fuse_direct_io(struct fuse_io_pr |
| count -= nres; |
| res += nres; |
| pos += nres; |
| - if (nres != nbytes) |
| + if (nres != nbytes) { |
| + iov_iter_revert(iter, nbytes - nres); |
| break; |
| + } |
| if (count) { |
| max_pages = iov_iter_npages(iter, fc->max_pages); |
| ia = fuse_io_alloc(io, max_pages); |