fix up iter on short count in fuse_direct_io()
commitf658adeea4
upstream. fuse_direct_io() can end up advancing the iterator by more than the amount of data read or written. This case is handled by the generic code if going through ->direct_IO(), but not in the FOPEN_DIRECT_IO case. Fix by reverting the extra bytes from the iterator in case of error or a short count. To test: install lxcfs, then the following testcase int fd = open("/var/lib/lxcfs/proc/uptime", O_RDONLY); sendfile(1, fd, NULL, 16777216); sendfile(1, fd, NULL, 16777216); will spew WARN_ON() in iov_iter_pipe(). Reported-by: Peter Geis <pgwipeout@gmail.com> Reported-by: Al Viro <viro@zeniv.linux.org.uk> Fixes:3c3db095b6
("fuse: use iov_iter based generic splice helpers") Cc: <stable@vger.kernel.org> # v5.1 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
e0fc65ef8a
commit
07fbef9a6e
|
@ -1465,6 +1465,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
|
||||||
}
|
}
|
||||||
ia = NULL;
|
ia = NULL;
|
||||||
if (nres < 0) {
|
if (nres < 0) {
|
||||||
|
iov_iter_revert(iter, nbytes);
|
||||||
err = nres;
|
err = nres;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
@ -1473,8 +1474,10 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
|
||||||
count -= nres;
|
count -= nres;
|
||||||
res += nres;
|
res += nres;
|
||||||
pos += nres;
|
pos += nres;
|
||||||
if (nres != nbytes)
|
if (nres != nbytes) {
|
||||||
|
iov_iter_revert(iter, nbytes - nres);
|
||||||
break;
|
break;
|
||||||
|
}
|
||||||
if (count) {
|
if (count) {
|
||||||
max_pages = iov_iter_npages(iter, fc->max_pages);
|
max_pages = iov_iter_npages(iter, fc->max_pages);
|
||||||
ia = fuse_io_alloc(io, max_pages);
|
ia = fuse_io_alloc(io, max_pages);
|
||||||
|
|
Loading…
Reference in New Issue