LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org,
	Linus Torvalds <torvalds@linux-foundation.org>
Cc: Justin Forbes <jmforbes@linuxtx.org>,
	Zwane Mwaikambo <zwane@arm.linux.org.uk>,
	"Theodore Ts'o" <tytso@mit.edu>,
	Randy Dunlap <rdunlap@xenotime.net>,
	Dave Jones <davej@redhat.com>,
	Chuck Wolber <chuckw@quantumlinux.com>,
	Chris Wedgwood <reviews@ml.cw.f00f.org>,
	Michael Krufky <mkrufky@linuxtv.org>,
	Chuck Ebbert <cebbert@redhat.com>,
	Domenico Andreoli <cavokz@gmail.com>,
	akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
	Nick Piggin <npiggin@suse.de>, Ingo Molnar <mingo@elte.hu>
Subject: [patch 42/45] fix writev regression: pan hanging unkillable and un-straceable
Date: Thu, 7 Feb 2008 12:48:19 -0800	[thread overview]
Message-ID: <20080207204819.GQ16389@suse.de> (raw)
In-Reply-To: <20080207204549.GA16389@suse.de>

[-- Attachment #1: fix-writev-regression-pan-hanging-unkillable-and-un-straceable.patch --]
[-- Type: text/plain, Size: 2088 bytes --]

2.6.24-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Nick Piggin <nickpiggin@yahoo.com.au>

patch 124d3b7041f9a0ca7c43a6293e1cae4576c32fd5 in mainline.

Frederik Himpe reported an unkillable and un-straceable pan process.

Zero length iovecs can go into an infinite loop in writev, because the 
iovec iterator does not always advance over them.

The sequence required to trigger this is not trivial. I think it 
requires that a zero-length iovec be followed by a non-zero-length iovec 
which causes a pagefault in the atomic usercopy. This causes the writev 
code to drop back into single-segment copy mode, which then tries to 
copy the 0 bytes of the zero-length iovec; a zero length copy looks like 
a failure though, so it loops.

Put a test into iov_iter_advance to catch zero-length iovecs. We could 
just put the test in the fallback path, but I feel it is more robust to 
skip over zero-length iovecs throughout the code (iovec iterator may be 
used in filesystems too, so it should be robust).

Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 mm/filemap.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1733,7 +1733,11 @@ static void __iov_iter_advance_iov(struc
 		const struct iovec *iov = i->iov;
 		size_t base = i->iov_offset;
 
-		while (bytes) {
+		/*
+		 * The !iov->iov_len check ensures we skip over unlikely
+		 * zero-length segments.
+		 */
+		while (bytes || !iov->iov_len) {
 			int copy = min(bytes, iov->iov_len - base);
 
 			bytes -= copy;
@@ -2251,6 +2255,7 @@ again:
 
 		cond_resched();
 
+		iov_iter_advance(i, copied);
 		if (unlikely(copied == 0)) {
 			/*
 			 * If we were unable to copy any data at all, we must
@@ -2264,7 +2269,6 @@ again:
 						iov_iter_single_seg_count(i));
 			goto again;
 		}
-		iov_iter_advance(i, copied);
 		pos += copied;
 		written += copied;
 

-- 

  parent reply	other threads:[~2008-02-07 21:14 UTC|newest]

Thread overview: 64+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20080207204118.202098927@mini.kroah.org>
2008-02-07 20:45 ` [patch 00/45] 2.6.24-stable review Greg KH
2008-02-07 20:46   ` [patch 01/45] DVB: cx23885: add missing subsystem ID for Hauppauge HVR1800 Retail Greg KH
2008-02-07 20:46   ` [patch 02/45] slab: fix bootstrap on memoryless node Greg KH
2008-02-07 20:46   ` [patch 03/45] vm audit: add VM_DONTEXPAND to mmap for drivers that need it (CVE-2008-0007) Greg KH
2008-02-07 20:46   ` [patch 04/45] USB: keyspan: Fix oops Greg KH
2008-02-07 20:46   ` [patch 05/45] usb gadget: fix fsl_usb2_udc potential OOPS Greg KH
2008-02-07 20:46   ` [patch 06/45] USB: CP2101 New Device IDs Greg KH
2008-02-07 20:46   ` [patch 07/45] USB: add support for 4348:5523 WinChipHead USB->RS 232 adapter Greg KH
2008-02-07 20:46   ` [patch 08/45] USB: Sierra - Add support for Aircard 881U Greg KH
2008-02-07 20:46   ` [patch 09/45] USB: Adding YC Cable USB Serial device to pl2303 Greg KH
2008-02-07 20:47   ` [patch 10/45] USB: sierra driver - add devices Greg KH
2008-02-07 20:47   ` [patch 11/45] USB: ftdi_sio - enabling multiple ELV devices, adding EM1010PC Greg KH
2008-02-07 20:47   ` [patch 12/45] USB: ftdi-sio: Patch to add vendor/device id for ATK_16IC CCD Greg KH
2008-02-07 20:47   ` [patch 13/45] USB: sierra: add support for Onda H600/Zte MF330 datacard to USB Driver for Sierra Wireless Greg KH
2008-02-08  2:21     ` [patch 13/45] USB: sierra: add support for Onda H600/Zte MF330datacard " Kevin Lloyd
2008-02-08  4:11       ` Greg KH
2008-02-08 16:50         ` [patch 13/45] USB: sierra: add support for Onda H600/ZteMF330datacard " Kevin Lloyd
2008-02-08 18:47           ` Greg KH
2008-02-07 20:47   ` [patch 14/45] USB: remove duplicate entry in Option driver and Pl2303 driver for Huawei modem Greg KH
2008-02-07 20:47   ` [patch 15/45] USB: pl2303: add support for RATOC REX-USB60F Greg KH
2008-02-07 20:47   ` [patch 16/45] USB: ftdi driver - add support for optical probe device Greg KH
2008-02-07 20:47   ` [patch 17/45] USB: use GFP_NOIO in reset path Greg KH
2008-02-07 20:47   ` [patch 18/45] USB: Variant of the Dell Wireless 5520 driver Greg KH
2008-02-07 20:47   ` [patch 19/45] USB: storage: Add unusual_dev for HP r707 Greg KH
2008-02-07 20:47   ` [patch 20/45] USB: fix usbtest halt check on big endian systems Greg KH
2008-02-07 20:47   ` [patch 21/45] USB: handle idVendor of 0x0000 Greg KH
2008-02-07 20:47   ` [patch 22/45] USB: Fix usb_serial_driver structure for Kobil cardreader driver Greg KH
2008-02-07 20:47   ` [patch 23/45] forcedeth: mac address mcp77/79 Greg KH
2008-02-07 20:47   ` [patch 24/45] lockdep: annotate epoll Greg KH
2008-02-07 20:47   ` [patch 25/45] sys_remap_file_pages: fix ->vm_file accounting Greg KH
2008-02-07 20:47   ` [patch 26/45] PCI: Fix fakephp deadlock Greg KH
2008-02-07 20:47   ` [patch 27/45] ACPI: update ACPI blacklist Greg KH
2008-02-07 20:47   ` [patch 28/45] x86: restore correct module name for apm Greg KH
2008-02-07 20:47   ` [patch 29/45] sky2: restore multicast addresses after recovery Greg KH
2008-02-07 20:47   ` [patch 30/45] sky2: fix for WOL on some devices Greg KH
2008-02-07 20:47   ` [patch 31/45] b43: Fix suspend/resume Greg KH
2008-02-07 20:47   ` [patch 32/45] b43: Drop packets we are not able to encrypt Greg KH
2008-02-07 20:47   ` [patch 33/45] b43: Fix dma-slot resource leakage Greg KH
2008-02-07 20:47   ` [patch 34/45] b43legacy: fix PIO crash Greg KH
2008-02-07 20:48   ` [patch 35/45] b43legacy: fix suspend/resume Greg KH
2008-02-07 20:48   ` [patch 36/45] b43legacy: drop packets we are not able to encrypt Greg KH
2008-02-07 20:48   ` [patch 37/45] b43legacy: fix DMA slot resource leakage Greg KH
2008-02-07 20:48   ` [patch 38/45] selinux: fix labeling of /proc/net inodes Greg KH
2008-02-07 20:48   ` [patch 39/45] b43: Reject new firmware early Greg KH
2008-02-07 20:48   ` [patch 40/45] sched: let +nice tasks have smaller impact Greg KH
2008-02-07 20:48   ` [patch 41/45] sched: fix high wake up latencies with FAIR_USER_SCHED Greg KH
2008-02-07 20:48   ` Greg KH [this message]
2008-02-07 20:48   ` [patch 43/45] x86: replace LOCK_PREFIX in futex.h Greg KH
2008-02-08 18:35     ` Stefan Lippers-Hollmann
2008-02-08 19:19       ` Greg KH
2008-02-08 21:45       ` Chuck Ebbert
2008-02-07 20:48   ` [patch 44/45] Driver core: Revert "Fix Firmware class name collision" Greg KH
2008-02-07 20:48   ` [patch 45/45] drm: the drm really should call pci_set_master Greg KH
2008-02-07 21:41   ` [patch 00/45] 2.6.24-stable review S.Çağlar Onur
2008-02-07 21:58     ` Greg KH
2008-02-09  0:57       ` [stable] " Greg KH
2008-02-07 23:50   ` Chuck Ebbert
2008-02-08  1:32     ` [stable] " Greg KH
2008-02-08  0:44   ` David Chinner
2008-02-08  1:12     ` [stable] " Greg KH
2008-02-08  1:24       ` David Chinner
2008-02-08  1:35         ` Greg KH
2008-02-08 22:26           ` [PATCH] stable_kernel_rules: fix must already be in mainline Stefan Richter
2008-02-08  5:31   ` [stable] [patch 00/45] 2.6.24-stable review Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20080207204819.GQ16389@suse.de \
    --to=gregkh@suse.de \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=cavokz@gmail.com \
    --cc=cebbert@redhat.com \
    --cc=chuckw@quantumlinux.com \
    --cc=davej@redhat.com \
    --cc=jmforbes@linuxtx.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@elte.hu \
    --cc=mkrufky@linuxtv.org \
    --cc=npiggin@suse.de \
    --cc=rdunlap@xenotime.net \
    --cc=reviews@ml.cw.f00f.org \
    --cc=stable@kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=tytso@mit.edu \
    --cc=zwane@arm.linux.org.uk \
    --subject='Re: [patch 42/45] fix writev regression: pan hanging unkillable and un-straceable' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).