On Sat, Oct 3, 2015 at 1:04 AM, Andrew Morton <a...@linux-foundation.org> wrote: > On Fri, 2 Oct 2015 12:27:45 -0700 Maxim Patlasov <mpatla...@parallels.com> > wrote: > >> On 10/02/2015 04:21 AM, Konstantin Khlebnikov wrote: >> > Bump. Add more peopple in CC. >> > >> > On Mon, Sep 21, 2015 at 1:02 PM, Roman Gushchin <kl...@yandex-team.ru> >> > wrote: >> >> I got a report about unkillable task eating CPU. Thge further >> >> investigation shows, that the problem is in the fuse_fill_write_pages() >> >> function. If iov's first segment has zero length, we get an infinite >> >> loop, because we never reach iov_iter_advance() call. >> >> iov_iter_copy_from_user_atomic() eventually calls iterate_iovec(). The >> latter silently consumes zero-length iov. So I don't think "iov's first >> segment has zero length" can cause infinite loop. > > I'm suspecting it got stuck because local variable `bytes' is zero, so > the code does `goto again' repeatedly. > > Or maybe not. A more complete description of the bug would help.
I suspect here is the same scenario like in 124d3b7041f: Zero-length segmend is followed by segment with invalid address: iov_iter_fault_in_readable() checks only first segment (zero-length) iov_iter_copy_from_user_atomic() skips it, fails at second and returns zero -> goto again without skipping zero-length segment. Patch calls iov_iter_advance() before goto again: we'll skip zero-length segment at second iteraction and iov_iter_fault_in_readable() will detect invalid address. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
