Commit f658adee authored by Miklos Szeredi's avatar Miklos Szeredi

fix up iter on short count in fuse_direct_io()

fuse_direct_io() can end up advancing the iterator by more than the amount
of data read or written.  This case is handled by the generic code if going
through ->direct_IO(), but not in the FOPEN_DIRECT_IO case.

Fix by reverting the extra bytes from the iterator in case of error or a
short count.

To test: install lxcfs, then the following testcase
  int fd = open("/var/lib/lxcfs/proc/uptime", O_RDONLY);
  sendfile(1, fd, NULL, 16777216);
  sendfile(1, fd, NULL, 16777216);
will spew WARN_ON() in iov_iter_pipe().
Reported-by: default avatarPeter Geis <pgwipeout@gmail.com>
Reported-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Fixes: 3c3db095 ("fuse: use iov_iter based generic splice helpers")
Cc: <stable@vger.kernel.org> # v5.1
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
parent d5226fa6
...@@ -1465,6 +1465,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, ...@@ -1465,6 +1465,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
} }
ia = NULL; ia = NULL;
if (nres < 0) { if (nres < 0) {
iov_iter_revert(iter, nbytes);
err = nres; err = nres;
break; break;
} }
...@@ -1473,8 +1474,10 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, ...@@ -1473,8 +1474,10 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
count -= nres; count -= nres;
res += nres; res += nres;
pos += nres; pos += nres;
if (nres != nbytes) if (nres != nbytes) {
iov_iter_revert(iter, nbytes - nres);
break; break;
}
if (count) { if (count) {
max_pages = iov_iter_npages(iter, fc->max_pages); max_pages = iov_iter_npages(iter, fc->max_pages);
ia = fuse_io_alloc(io, max_pages); ia = fuse_io_alloc(io, max_pages);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment