On Thu, Apr 23, 2015 at 01:16:15PM +0300, Andrey Ryabinin wrote:
> This change caused following:
> This could happen when p9pdu_readf() changes 'count' to some value > iov_iter_count(from):
>
> p9_client_write():
> <...>
> int count = iov_iter_count(from);
> <...>
> *err = p9pdu_readf(req->rc, clnt->proto_version, "d", &count);
> <...>
> iov_iter_advance(from, count);
*blink*
That's a bug, all right, but I would love to see how you trigger it.
It would require server to respond to "write that many bytes" with "OK,
<greater number> bytes written". We certainly need to cope with that
(we can't trust the server to be sane), but if that's what is going on,
you've got a server bug as well.
Could you check if the patch below triggers WARN_ON() in it on your
reproducer? p9_client_read() has a similar issue as well...
diff --git a/net/9p/client.c b/net/9p/client.c
index 6f4c4c8..f99bce7 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -1588,6 +1588,10 @@ p9_client_read(struct p9_fid *fid, u64 offset, struct iov_iter *to, int *err)
p9_free_req(clnt, req);
break;
}
+ if (count > rsize) {
+ WARN_ON(1);
+ count = rsize;
+ }
if (non_zc) {
int n = copy_to_iter(dataptr, count, to);
@@ -1650,6 +1654,10 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err)
}
p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", count);
+ if (count > rsize) {
+ WARN_ON(1);
+ count = rsize;
+ }
p9_free_req(clnt, req);
iov_iter_advance(from, count);
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
