From fb32e21bb9b345023398f1fed1c3a2d2ecb08a78 Mon Sep 17 00:00:00 2001 From: Kent Overstreet Date: Mon, 12 Jul 2021 21:48:51 +0800 Subject: [PATCH] mm/filemap: fix infinite loop in generic_file_buffered_read() mainline inclusion from mainline-v5.11-rc1 commit 3644e2d2dda78e21edd8f5415b6d7ab03f5f54f3 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I40B5X CVE: NA ------------------------------------------------- If iter->count is 0 and iocb->ki_pos is page aligned, this causes nr_pages to be 0. Then in generic_file_buffered_read_get_pages() find_get_pages_contig() returns 0 - because we asked for 0 pages, so we call generic_file_buffered_read_no_cached_page() which attempts to add a page to the page cache, which fails with -EEXIST, and then we loop. Oops... Signed-off-by: Kent Overstreet Reported-by: Jens Axboe Reviewed-by: Jens Axboe Signed-off-by: Linus Torvalds Signed-off-by: Nanyong Sun Reviewed-by: Tong Tiangen Signed-off-by: Zheng Zengkai --- mm/filemap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/filemap.c b/mm/filemap.c index 31729c67be94..446b6d6c4e64 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -2464,6 +2464,9 @@ ssize_t generic_file_buffered_read(struct kiocb *iocb, if (unlikely(iocb->ki_pos >= inode->i_sb->s_maxbytes)) return 0; + if (unlikely(!iov_iter_count(iter))) + return 0; + iov_iter_truncate(iter, inode->i_sb->s_maxbytes); if (nr_pages > ARRAY_SIZE(pages_onstack)) -- GitLab