netdev - Re: [PATCH v5 00/12] netfs, cifs: Delegate high-level I/O to netfslib

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <187507.1708357334@warthog.procyon.org.uk>
Date: Mon, 19 Feb 2024 15:42:14 +0000
From: David Howells <dhowells@...hat.com>
To: Steve French <smfrench@...il.com>
Cc: dhowells@...hat.com, Jeff Layton <jlayton@...nel.org>,
    Matthew Wilcox <willy@...radead.org>,
    Paulo Alcantara <pc@...guebit.com>,
    Shyam Prasad N <sprasad@...rosoft.com>, Tom Talpey <tom@...pey.com>,
    Christian Brauner <christian@...uner.io>, netfs@...ts.linux.dev,
    linux-cifs@...r.kernel.org, linux-fsdevel@...r.kernel.org,
    linux-mm@...ck.org, netdev@...r.kernel.org,
    linux-kernel@...r.kernel.org
Subject: Re: [PATCH v5 00/12] netfs, cifs: Delegate high-level I/O to netfslib

David Howells <dhowells@...hat.com> wrote:

> I don't suppose you can tell me what line smb2_readv_callback+0x50f/0x5b0 is?

It's almost certainly the iov_iter_revert() here:

	switch (mid->mid_state) {
	case MID_RESPONSE_RECEIVED:
		credits.value = le16_to_cpu(shdr->CreditRequest);
		credits.instance = server->reconnect_instance;
		/* result already set, check signature */
		if (server->sign && !mid->decrypted) {
			int rc;

			iov_iter_revert(&rqst.rq_iter, rdata->got_bytes);
			iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes);

The reason that the:

	[  228.573737] kernel BUG at lib/iov_iter.c:582!

happens is that we're trying to wind the iterator back before its start point.

Now, the iterator is reinitialised at the beginning of the function:

	if (rdata->got_bytes) {
		rqst.rq_iter	  = rdata->subreq.io_iter;
		rqst.rq_iter_size = iov_iter_count(&rdata->subreq.io_iter);
	}

so the reversion is probably unnecessary.

Note that this can only happen if we're using signed messages:

		if (server->sign && !mid->decrypted) {

as we wind back the iterator so that we can use it to feed the buffer to the
hashing algorithm.

David