linux-kernel - Re: fs: possible deadlock in do_iter_write/do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20170706131834.GP10672@ZenIV.linux.org.uk>
Date:   Thu, 6 Jul 2017 14:18:34 +0100
From:   Al Viro <viro@...IV.linux.org.uk>
To:     Andrey Konovalov <andreyknvl@...gle.com>
Cc:     linux-fsdevel@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        Christoph Hellwig <hch@....de>
Subject: Re: fs: possible deadlock in do_iter_write/do_splice

On Thu, Jul 06, 2017 at 03:01:11PM +0200, Andrey Konovalov wrote:
> Hi,
> 
> I've got the following error report while fuzzing the kernel with syzkaller.
> 
> On commit 9b51f04424e17051a89ab32d892ca66b2a104825 (4.12+).

It's "fs: implement vfs_iter_write using do_iter_write", actually.

vfs_iter_write() has no business playing with file_start_write(); do_iter_write()
does.  

commit 62473a2d6f513296e896b64ccfd7ceb7b963795e
Author: Al Viro <viro@...iv.linux.org.uk>
Date:   Thu Jul 6 09:15:47 2017 -0400

    move file_{start,end}_write() out of do_iter_write()
    
    ... and do *not* grab it in vfs_write_iter().
    
    Fixes: "fs: implement vfs_iter_read using do_iter_read"
    Signed-off-by: Al Viro <viro@...iv.linux.org.uk>

diff --git a/fs/read_write.c b/fs/read_write.c
index acfd3dc63d57..be1125b30aec 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -931,12 +931,10 @@ static ssize_t do_iter_write(struct file *file, struct iov_iter *iter,
 	if (ret < 0)
 		return ret;
 
-	file_start_write(file);
 	if (file->f_op->write_iter)
 		ret = do_iter_readv_writev(file, iter, pos, WRITE, flags);
 	else
 		ret = do_loop_readv_writev(file, iter, pos, WRITE, flags);
-	file_end_write(file);
 	if (ret > 0)
 		fsnotify_modify(file);
 	return ret;
@@ -979,7 +977,9 @@ ssize_t vfs_writev(struct file *file, const struct iovec __user *vec,
 
 	ret = import_iovec(WRITE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
 	if (ret >= 0) {
+		file_start_write(file);
 		ret = do_iter_write(file, &iter, pos, flags);
+		file_end_write(file);
 		kfree(iov);
 	}
 	return ret;
@@ -1247,7 +1247,9 @@ static size_t compat_writev(struct file *file,
 
 	ret = compat_import_iovec(WRITE, vec, vlen, UIO_FASTIOV, &iov, &iter);
 	if (ret >= 0) {
+		file_start_write(file);
 		ret = do_iter_write(file, &iter, pos, flags);
+		file_end_write(file);
 		kfree(iov);
 	}
 	if (ret > 0)