Roman Gushchin 3ca8138f01 fuse: break infinite loop in fuse_fill_write_pages() ... I got a report about unkillable task eating CPU. Further investigation shows, that the problem is in the fuse_fill_write_pages() function. If iov's first segment has zero length, we get an infinite loop, because we never reach iov_iter_advance() call. Fix this by calling iov_iter_advance() before repeating an attempt to copy data from userspace. A similar problem is described in 124d3b7041 ("fix writev regression: pan hanging unkillable and un-straceable"). If zero-length segmend is followed by segment with invalid address, iov_iter_fault_in_readable() checks only first segment (zero-length), iov_iter_copy_from_user_atomic() skips it, fails at second and returns zero -> goto again without skipping zero-length segment. Patch calls iov_iter_advance() before goto again: we'll skip zero-length segment at second iteraction and iov_iter_fault_in_readable() will detect invalid address. Special thanks to Konstantin Khlebnikov, who helped a lot with the commit description. Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Maxim Patlasov <mpatlasov@parallels.com> Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Signed-off-by: Roman Gushchin <klamm@yandex-team.ru> Signed-off-by: Miklos Szeredi <miklos@szeredi.hu> Fixes: ea9b9907b8 ("fuse: implement perform_write") Cc: <stable@vger.kernel.org>		2015-11-10 10:32:37 +01:00
..
control.c	VFS: normal filesystems (and lustre): d_inode() annotations	2015-04-15 15:06:57 -04:00
cuse.c	cuse: fix memory leak	2015-11-10 10:32:36 +01:00
dev.c	fs/fuse: fix ioctl type confusion	2015-08-16 12:35:44 -07:00
dir.c	new helper: free_page_put_link()	2015-05-11 08:13:13 -04:00
file.c	fuse: break infinite loop in fuse_fill_write_pages()	2015-11-10 10:32:37 +01:00
fuse_i.h	fuse: separate pqueue for clones	2015-07-01 16:26:09 +02:00
inode.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2015-07-03 15:20:57 -07:00
Kconfig
Makefile