Patch "mm/filemap: fix infinite loop in generic_file_buffered_read()" has been added to the 5.10-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    mm/filemap: fix infinite loop in generic_file_buffered_read()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mm-filemap-fix-infinite-loop-in-generic_file_buffered_read.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From 3644e2d2dda78e21edd8f5415b6d7ab03f5f54f3 Mon Sep 17 00:00:00 2001
From: Kent Overstreet <kent.overstreet@xxxxxxxxx>
Date: Fri, 18 Dec 2020 04:07:11 -0500
Subject: mm/filemap: fix infinite loop in generic_file_buffered_read()

From: Kent Overstreet <kent.overstreet@xxxxxxxxx>

commit 3644e2d2dda78e21edd8f5415b6d7ab03f5f54f3 upstream.

If iter->count is 0 and iocb->ki_pos is page aligned, this causes
nr_pages to be 0.

Then in generic_file_buffered_read_get_pages() find_get_pages_contig()
returns 0 - because we asked for 0 pages, so we call
generic_file_buffered_read_no_cached_page() which attempts to add a page
to the page cache, which fails with -EEXIST, and then we loop. Oops...

Signed-off-by: Kent Overstreet <kent.overstreet@xxxxxxxxx>
Reported-by: Jens Axboe <axboe@xxxxxxxxx>
Reviewed-by: Jens Axboe <axboe@xxxxxxxxx>
Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Suraj Jitindar Singh <surajjs@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 mm/filemap.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2203,6 +2203,9 @@ ssize_t generic_file_buffered_read(struc
 
 	if (unlikely(*ppos >= inode->i_sb->s_maxbytes))
 		return 0;
+	if (unlikely(!iov_iter_count(iter)))
+		return 0;
+
 	iov_iter_truncate(iter, inode->i_sb->s_maxbytes);
 
 	index = *ppos >> PAGE_SHIFT;


Patches currently in stable-queue which might be from kent.overstreet@xxxxxxxxx are

queue-5.10/mm-filemap-fix-infinite-loop-in-generic_file_buffered_read.patch



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux