linux-kernel - Re: [fuse] 6b2fb79963: WARNING:at_fs/fuse/file.c:#tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <ea00a67e-5a61-2e70-215e-004e3dcc57c1@virtuozzo.com>
Date:   Mon, 15 Jun 2020 08:59:47 +0300
From:   Vasily Averin <vvs@...tuozzo.com>
To:     Miklos Szeredi <mszeredi@...hat.com>
Cc:     Maxim Patlasov <maximvp@...il.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [fuse] 6b2fb79963: WARNING:at_fs/fuse/file.c:#tree_insert[fuse]

On 6/15/20 3:50 AM, kernel test robot wrote:
> FYI, we noticed the following commit (built with gcc-9):
> 
> commit: 6b2fb79963fbed7db3ef850926d913518fd5c62f ("fuse: optimize writepages search")
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master

> [ 1030.995703] ------------[ cut here ]------------
> [ 1030.997563] WARNING: CPU: 1 PID: 17211 at fs/fuse/file.c:1728 tree_insert+0xab/0xc0 [fuse]
> [ 1031.021943] RIP: 0010:tree_insert+0xab/0xc0 [fuse]
> [ 1031.057802] Call Trace:
> [ 1031.060015]  fuse_writepages_fill+0x5da/0x6a0 [fuse]
> [ 1031.062536]  write_cache_pages+0x171/0x470
> [ 1031.064933]  ? fuse_writepages+0x100/0x100 [fuse]
> [ 1031.067419]  ? terminate_walk+0xd3/0xf0
> [ 1031.069707]  ? _cond_resched+0x19/0x30
> [ 1031.072140]  ? __kmalloc+0x274/0x280
> [ 1031.074407]  fuse_writepages+0x8a/0x100 [fuse]
> [ 1031.076599]  do_writepages+0x43/0xe0

It is  WARN_ON(!wpa->ia.ap.num_pages);
however tree_insert() was called from fuse_writepages_fill() with ap->num_pages = 0;
In submitted PATCH RFC we have used 

+static int tree_insert(struct rb_root *root, struct fuse_req *ins_req)
...
+	pgoff_t idx_to   = idx_from + (ins_req->num_pages ?
+				ins_req->num_pages - 1 : 0);

Though committed patch version have 

+static void tree_insert(struct rb_root *root, struct fuse_writepage_args *wpa)
...
+       pgoff_t idx_to = idx_from + wpa->ia.ap.num_pages - 1;
...
+       WARN_ON(!wpa->ia.ap.num_pages);

Miklos,
do you have any objections if I return to our initial proposal?
Am I missed something and it is not allowed now?

Thank you,
	Vasily Averin

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index e573b0c..b8c3ef4 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1677,11 +1677,11 @@ void fuse_flush_writepages(struct inode *inode)
 static void tree_insert(struct rb_root *root, struct fuse_writepage_args *wpa)
 {
        pgoff_t idx_from = wpa->ia.write.in.offset >> PAGE_SHIFT;
-       pgoff_t idx_to = idx_from + wpa->ia.ap.num_pages - 1;
+       pgoff_t idx_to = idx_from + (wpa->ia.ap.num_pages ?
+                               wpa->ia.ap.num_pages - 1 : 0) ;
        struct rb_node **p = &root->rb_node;
        struct rb_node  *parent = NULL;
 
-       WARN_ON(!wpa->ia.ap.num_pages);
        while (*p) {
                struct fuse_writepage_args *curr;
                pgoff_t curr_index;