Re: virtiofs: WARN_ON(out_sgs + in_sgs != total_sgs)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, Oct 04, 2020 at 10:31:19AM -0400, Vivek Goyal wrote:
> On Fri, Oct 02, 2020 at 10:44:37PM -0400, Qian Cai wrote:
> > On Fri, 2020-10-02 at 12:28 -0400, Qian Cai wrote:
> > > Running some fuzzing on virtiofs from a non-privileged user could trigger a
> > > warning in virtio_fs_enqueue_req():
> > > 
> > > WARN_ON(out_sgs + in_sgs != total_sgs);
> > 
> > Okay, I can reproduce this after running for a few hours:
> > 
> > out_sgs = 3, in_sgs = 2, total_sgs = 6
> 
> Thanks. I can also reproduce it simply by calling.
> 
> ioctl(fd, 0x5a004000, buf);
> 
> I think following WARN_ON() is not correct.
> 
> WARN_ON(out_sgs + in_sgs != total_sgs)
> 
> toal_sgs should actually be max sgs. It looks at ap->num_pages and
> counts one sg for each page. And it assumes that same number of
> pages will be used both for input and output.
> 
> But there are no such guarantees. With above ioctl() call, I noticed
> we are using 2 pages for input (out_sgs) and one page for output (in_sgs).
> 
> So out_sgs=4, in_sgs=3 and total_sgs=8 and warning triggers.
> 
> I think total sgs is actually max number of sgs and warning
> should probably be.
> 
> WARN_ON(out_sgs + in_sgs >  total_sgs)
> 
> Stefan, WDYT?

It should be possible to calculate total_sgs precisely (not a maximum).
Treating it as a maximum could hide bugs.

Maybe sg_count_fuse_req() should count in_args/out_args[numargs -
1].size pages instead of adding ap->num_pages.

Do you have the details of struct fuse_req and struct fuse_args_pages
fields for the ioctl in question?

Thanks,
Stefan

Attachment: signature.asc
Description: PGP signature


[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]

  Powered by Linux