linux/mm
Nick Piggin 124d3b7041 fix writev regression: pan hanging unkillable and un-straceable
Frederik Himpe reported an unkillable and un-straceable pan process.

Zero length iovecs can go into an infinite loop in writev, because the
iovec iterator does not always advance over them.

The sequence required to trigger this is not trivial. I think it
requires that a zero-length iovec be followed by a non-zero-length iovec
which causes a pagefault in the atomic usercopy. This causes the writev
code to drop back into single-segment copy mode, which then tries to
copy the 0 bytes of the zero-length iovec; a zero length copy looks like
a failure though, so it loops.

Put a test into iov_iter_advance to catch zero-length iovecs. We could
just put the test in the fallback path, but I feel it is more robust to
skip over zero-length iovecs throughout the code (iovec iterator may be
used in filesystems too, so it should be robust).

Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-02-03 07:55:39 +11:00
..
allocpercpu.c
backing-dev.c
bootmem.c
bounce.c
fadvise.c
filemap_xip.c xip: fix get_zeroed_page with __GFP_HIGHMEM 2008-01-08 16:10:36 -08:00
filemap.c fix writev regression: pan hanging unkillable and un-straceable 2008-02-03 07:55:39 +11:00
fremap.c
highmem.c
hugetlb.c fix hugepages leak due to pagetable page sharing 2008-01-24 08:07:27 -08:00
internal.h
Kconfig sh: Bump number of quicklists for SH-5. 2008-01-28 13:18:55 +09:00
madvise.c
Makefile
memory_hotplug.c
memory.c x86: print which shared library/executable faulted in segfault etc. messages v3 2008-01-30 13:33:18 +01:00
mempolicy.c
mempool.c
migrate.c
mincore.c
mlock.c
mmap.c x86: randomize brk 2008-01-30 13:30:40 +01:00
mmzone.c
mprotect.c
mremap.c
msync.c
nommu.c
oom_kill.c sched: sched_rt_entity 2008-01-25 21:08:27 +01:00
page_alloc.c mm: fix section mismatch warning in page_alloc.c 2008-01-17 15:38:58 -08:00
page_io.c
page_isolation.c
page-writeback.c Revert "writeback: introduce writeback_control.more_io to indicate more io" 2008-01-14 21:21:29 -08:00
pdflush.c
prio_tree.c
quicklist.c quicklists: Only consider memory that can be used with GFP_KERNEL 2008-01-14 08:52:22 -08:00
readahead.c
rmap.c
shmem_acl.c
shmem.c
slab.c cpu-hotplug: replace per-subsystem mutexes with get_online_cpus() 2008-01-25 21:08:02 +01:00
slob.c
slub.c Kobject: convert mm/slub.c to use kobject_init/add_ng() 2008-01-24 20:40:31 -08:00
sparse-vmemmap.c
sparse.c mm/sparse.c: improve the error handling for sparse_add_one_section() 2007-12-17 19:28:16 -08:00
swap_state.c
swap.c
swapfile.c
thrash.c
tiny-shmem.c
truncate.c
util.c
vmalloc.c
vmscan.c
vmstat.c