On Thu, Jul 06, 2017 at 03:01:11PM +0200, Andrey Konovalov wrote:
> Hi,
>
> I've got the following error report while fuzzing the kernel with syzkaller.
>
> On commit 9b51f04424e17051a89ab32d892ca66b2a104825 (4.12+).
It's "fs: implement vfs_iter_write using do_iter_write", actually.
vfs_iter_write() has no business playing with file_start_write(); do_iter_write()
does.
commit 62473a2d6f513296e896b64ccfd7ceb7b963795e
Author: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Date: Thu Jul 6 09:15:47 2017 -0400
move file_{start,end}_write() out of do_iter_write()
... and do *not* grab it in vfs_write_iter().
Fixes: "fs: implement vfs_iter_read using do_iter_read"
Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
diff --git a/fs/read_write.c b/fs/read_write.c
index acfd3dc63d57..be1125b30aec 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -931,12 +931,10 @@ static ssize_t do_iter_write(struct file *file, struct iov_iter *iter,
if (ret < 0)
return ret;
- file_start_write(file);
if (file->f_op->write_iter)
ret = do_iter_readv_writev(file, iter, pos, WRITE, flags);
else
ret = do_loop_readv_writev(file, iter, pos, WRITE, flags);
- file_end_write(file);
if (ret > 0)
fsnotify_modify(file);
return ret;
@@ -979,7 +977,9 @@ ssize_t vfs_writev(struct file *file, const struct iovec __user *vec,
ret = import_iovec(WRITE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
if (ret >= 0) {
+ file_start_write(file);
ret = do_iter_write(file, &iter, pos, flags);
+ file_end_write(file);
kfree(iov);
}
return ret;
@@ -1247,7 +1247,9 @@ static size_t compat_writev(struct file *file,
ret = compat_import_iovec(WRITE, vec, vlen, UIO_FASTIOV, &iov, &iter);
if (ret >= 0) {
+ file_start_write(file);
ret = do_iter_write(file, &iter, pos, flags);
+ file_end_write(file);
kfree(iov);
}
if (ret > 0)
