lkml.org 
[lkml]   [2023]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [syzbot] general protection fault in skb_dequeue (3)
Date
David Howells <dhowells@redhat.com> wrote:

> I think I have managed to isolate the bug to the read side of sendfile() or
> the pipe in the middle by the following:
>
> In iter_file_splice_write(), I allocate a permanent page:
> ...
> and then stick it into the BVEC iter to be handed over to vfs_iter_write()
> instead of buf->page:
>
> - array[n].bv_page = buf->page;
> + array[n].bv_page = splice_tmp;
> + trace_page_ref_set(splice_tmp, 887);
> array[n].bv_len = this_len;
> array[n].bv_offset = buf->offset;
>
> that prevents vfs_iter_write() from ever seeing the pages from the pipe - but
> the crash still happens even with this change.

With the DIO output isolation in iov_iter_extract_pipe_pages(), this change
can be removed without causing oopses to happen.

David

\
 
 \ /
  Last update: 2023-03-27 00:09    [W:0.080 / U:0.392 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site