]> git.baikalelectronics.ru Git - kernel.git/commit
fix up iter on short count in fuse_direct_io()
authorMiklos Szeredi <mszeredi@redhat.com>
Thu, 6 Feb 2020 15:39:28 +0000 (16:39 +0100)
committerMiklos Szeredi <mszeredi@redhat.com>
Thu, 6 Feb 2020 15:39:28 +0000 (16:39 +0100)
commitcb0633006da6a6c35e72cb41dce6fcb8f5161e99
tree0d177c030953383081c2521fd9b2059695beb1d0
parentf5033ec79b00ab87091d46b54e6d738c645576d0
fix up iter on short count in fuse_direct_io()

fuse_direct_io() can end up advancing the iterator by more than the amount
of data read or written.  This case is handled by the generic code if going
through ->direct_IO(), but not in the FOPEN_DIRECT_IO case.

Fix by reverting the extra bytes from the iterator in case of error or a
short count.

To test: install lxcfs, then the following testcase
  int fd = open("/var/lib/lxcfs/proc/uptime", O_RDONLY);
  sendfile(1, fd, NULL, 16777216);
  sendfile(1, fd, NULL, 16777216);
will spew WARN_ON() in iov_iter_pipe().

Reported-by: Peter Geis <pgwipeout@gmail.com>
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Fixes: 11bf5085e8c3 ("fuse: use iov_iter based generic splice helpers")
Cc: <stable@vger.kernel.org> # v5.1
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
fs/fuse/file.c