Skip to contentSkip to conversation

5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

DISCUSSION Zubin Mithra 4 participants 4 messages Apr 23, 2019 – Apr 24, 2019 Stable branch

lore
Share & tools
lore

Zubin Mithra

author
#0 lore raw

Hello,

Syzkaller has triggered a kernel WARNING with the following stacktrace when fuzzing a 4.14 kernel.

Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb7/0x107 lib/dump_stack.c:53
 panic+0x1c9/0x3ae kernel/panic.c:181
 __warn+0x160/0x1a8 kernel/panic.c:543
 report_bug+0x123/0x18b lib/bug.c:186
 fixup_bug+0x3e/0x77 arch/x86/kernel/traps.c:177
 do_error_trap+0xdd/0x1e6 arch/x86/kernel/traps.c:295
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
 do_blockdev_direct_IO+0x1b08/0x1b95 fs/direct-io.c:1373
 ext4_direct_IO_write fs/ext4/inode.c:3696 [inline]
 ext4_direct_IO+0x8de/0xdad fs/ext4/inode.c:3826
 generic_file_direct_write+0x223/0x36b mm/filemap.c:2927
 __generic_file_write_iter+0x12f/0x2f8 mm/filemap.c:3106
 ext4_file_write_iter+0x97d/0xade fs/ext4/file.c:264
 call_write_iter include/linux/fs.h:1782 [inline]
 do_iter_readv_writev+0x1e4/0x27c fs/read_write.c:678
 do_iter_write+0x136/0x18f fs/read_write.c:957
 vfs_iter_write+0x81/0x98 fs/read_write.c:970
 iter_file_splice_write+0x4dc/0x7a6 fs/splice.c:749
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x11e/0x129 fs/splice.c:1018
 splice_direct_to_actor+0x342/0x5b0 fs/splice.c:973
 do_splice_direct+0x180/0x1ff fs/splice.c:1061
 do_sendfile+0x3e6/0x61c fs/read_write.c:1438
 SYSC_sendfile64 fs/read_write.c:1499 [inline]
 SyS_sendfile64+0xe9/0x128 fs/read_write.c:1485
 do_syscall_64+0x203/0x241 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Could the following patch be applied in order to v4.14.y(The patch is present in v4.19.y)? 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

Tests run:
- Chrome OS tryjobs
- Syzkaller reproducer

Thanks,
- Zubin

#1 lore raw
Quoted 34 lines · Zubin Mithra

Hello,

Syzkaller has triggered a kernel WARNING with the following stacktrace when fuzzing a 4.14 kernel.

Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb7/0x107 lib/dump_stack.c:53
 panic+0x1c9/0x3ae kernel/panic.c:181
 __warn+0x160/0x1a8 kernel/panic.c:543
 report_bug+0x123/0x18b lib/bug.c:186
 fixup_bug+0x3e/0x77 arch/x86/kernel/traps.c:177
 do_error_trap+0xdd/0x1e6 arch/x86/kernel/traps.c:295
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
 do_blockdev_direct_IO+0x1b08/0x1b95 fs/direct-io.c:1373
 ext4_direct_IO_write fs/ext4/inode.c:3696 [inline]
 ext4_direct_IO+0x8de/0xdad fs/ext4/inode.c:3826
 generic_file_direct_write+0x223/0x36b mm/filemap.c:2927
 __generic_file_write_iter+0x12f/0x2f8 mm/filemap.c:3106
 ext4_file_write_iter+0x97d/0xade fs/ext4/file.c:264
 call_write_iter include/linux/fs.h:1782 [inline]
 do_iter_readv_writev+0x1e4/0x27c fs/read_write.c:678
 do_iter_write+0x136/0x18f fs/read_write.c:957
 vfs_iter_write+0x81/0x98 fs/read_write.c:970
 iter_file_splice_write+0x4dc/0x7a6 fs/splice.c:749
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x11e/0x129 fs/splice.c:1018
 splice_direct_to_actor+0x342/0x5b0 fs/splice.c:973
 do_splice_direct+0x180/0x1ff fs/splice.c:1061
 do_sendfile+0x3e6/0x61c fs/read_write.c:1438
 SYSC_sendfile64 fs/read_write.c:1499 [inline]
 SyS_sendfile64+0xe9/0x128 fs/read_write.c:1485
 do_syscall_64+0x203/0x241 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
Quoted 2 lines

Could the following patch be applied in order to v4.14.y(The patch is present in v4.19.y)? 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

That patch only teaches the kernel to emit warnings in dmesg when programs mix directio and buffered writes. It doesn't fix any buggy directio usage. Someone on the ext4 list [cc'd] might know more about this.

--D

Quoted 8 lines

Tests run:
- Chrome OS tryjobs
- Syzkaller reproducer

Thanks,
- Zubin

#2 lore raw
Quoted 36 lines · Darrick J. Wong
Quoted 34 lines · Zubin Mithra

Hello,

Syzkaller has triggered a kernel WARNING with the following stacktrace when fuzzing a 4.14 kernel.

Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb7/0x107 lib/dump_stack.c:53
 panic+0x1c9/0x3ae kernel/panic.c:181
 __warn+0x160/0x1a8 kernel/panic.c:543
 report_bug+0x123/0x18b lib/bug.c:186
 fixup_bug+0x3e/0x77 arch/x86/kernel/traps.c:177
 do_error_trap+0xdd/0x1e6 arch/x86/kernel/traps.c:295
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
 do_blockdev_direct_IO+0x1b08/0x1b95 fs/direct-io.c:1373
 ext4_direct_IO_write fs/ext4/inode.c:3696 [inline]
 ext4_direct_IO+0x8de/0xdad fs/ext4/inode.c:3826
 generic_file_direct_write+0x223/0x36b mm/filemap.c:2927
 __generic_file_write_iter+0x12f/0x2f8 mm/filemap.c:3106
 ext4_file_write_iter+0x97d/0xade fs/ext4/file.c:264
 call_write_iter include/linux/fs.h:1782 [inline]
 do_iter_readv_writev+0x1e4/0x27c fs/read_write.c:678
 do_iter_write+0x136/0x18f fs/read_write.c:957
 vfs_iter_write+0x81/0x98 fs/read_write.c:970
 iter_file_splice_write+0x4dc/0x7a6 fs/splice.c:749
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x11e/0x129 fs/splice.c:1018
 splice_direct_to_actor+0x342/0x5b0 fs/splice.c:973
 do_splice_direct+0x180/0x1ff fs/splice.c:1061
 do_sendfile+0x3e6/0x61c fs/read_write.c:1438
 SYSC_sendfile64 fs/read_write.c:1499 [inline]
 SyS_sendfile64+0xe9/0x128 fs/read_write.c:1485
 do_syscall_64+0x203/0x241 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
Quoted 8 lines
Quoted 2 lines

Could the following patch be applied in order to v4.14.y(The patch is present in v4.19.y)? 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

That patch only teaches the kernel to emit warnings in dmesg when programs mix directio and buffered writes. It doesn't fix any buggy directio usage. Someone on the ext4 list [cc'd] might know more about this.

Not sure I understand. Is your argument that systems configured to panic on warnings should indeed panic if the situation is encountered, ie that the backtrace and potential panic is warranted ? Isn't this a potential DOS problem if the situation can be triggered from userspace on such systems ?

Thanks,
Guenter

Quoted 10 lines

--D

Quoted 8 lines

Tests run:
- Chrome OS tryjobs
- Syzkaller reproducer

Thanks,
- Zubin

maintainer
#3 lore raw
In reply to Zubin Mithra
Quoted 34 lines · Zubin Mithra

Hello,

Syzkaller has triggered a kernel WARNING with the following stacktrace when fuzzing a 4.14 kernel.

Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb7/0x107 lib/dump_stack.c:53
 panic+0x1c9/0x3ae kernel/panic.c:181
 __warn+0x160/0x1a8 kernel/panic.c:543
 report_bug+0x123/0x18b lib/bug.c:186
 fixup_bug+0x3e/0x77 arch/x86/kernel/traps.c:177
 do_error_trap+0xdd/0x1e6 arch/x86/kernel/traps.c:295
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
 do_blockdev_direct_IO+0x1b08/0x1b95 fs/direct-io.c:1373
 ext4_direct_IO_write fs/ext4/inode.c:3696 [inline]
 ext4_direct_IO+0x8de/0xdad fs/ext4/inode.c:3826
 generic_file_direct_write+0x223/0x36b mm/filemap.c:2927
 __generic_file_write_iter+0x12f/0x2f8 mm/filemap.c:3106
 ext4_file_write_iter+0x97d/0xade fs/ext4/file.c:264
 call_write_iter include/linux/fs.h:1782 [inline]
 do_iter_readv_writev+0x1e4/0x27c fs/read_write.c:678
 do_iter_write+0x136/0x18f fs/read_write.c:957
 vfs_iter_write+0x81/0x98 fs/read_write.c:970
 iter_file_splice_write+0x4dc/0x7a6 fs/splice.c:749
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x11e/0x129 fs/splice.c:1018
 splice_direct_to_actor+0x342/0x5b0 fs/splice.c:973
 do_splice_direct+0x180/0x1ff fs/splice.c:1061
 do_sendfile+0x3e6/0x61c fs/read_write.c:1438
 SYSC_sendfile64 fs/read_write.c:1499 [inline]
 SyS_sendfile64+0xe9/0x128 fs/read_write.c:1485
 do_syscall_64+0x203/0x241 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
Quoted 2 lines

Could the following patch be applied in order to v4.14.y(The patch is present in v4.19.y)? 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace")

Now queued up, thanks.

greg k-h