提交 fb32e21b 编写于 作者: K Kent Overstreet 提交者: Zheng Zengkai

mm/filemap: fix infinite loop in generic_file_buffered_read()

mainline inclusion
from mainline-v5.11-rc1
commit 3644e2d2
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I40B5X
CVE: NA

-------------------------------------------------

If iter->count is 0 and iocb->ki_pos is page aligned, this causes
nr_pages to be 0.

Then in generic_file_buffered_read_get_pages() find_get_pages_contig()
returns 0 - because we asked for 0 pages, so we call
generic_file_buffered_read_no_cached_page() which attempts to add a page
to the page cache, which fails with -EEXIST, and then we loop. Oops...
Signed-off-by: NKent Overstreet <kent.overstreet@gmail.com>
Reported-by: NJens Axboe <axboe@kernel.dk>
Reviewed-by: NJens Axboe <axboe@kernel.dk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NNanyong Sun <sunnanyong@huawei.com>
Reviewed-by: NTong Tiangen <tongtiangen@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
上级 eaa2e93a
...@@ -2464,6 +2464,9 @@ ssize_t generic_file_buffered_read(struct kiocb *iocb, ...@@ -2464,6 +2464,9 @@ ssize_t generic_file_buffered_read(struct kiocb *iocb,
if (unlikely(iocb->ki_pos >= inode->i_sb->s_maxbytes)) if (unlikely(iocb->ki_pos >= inode->i_sb->s_maxbytes))
return 0; return 0;
if (unlikely(!iov_iter_count(iter)))
return 0;
iov_iter_truncate(iter, inode->i_sb->s_maxbytes); iov_iter_truncate(iter, inode->i_sb->s_maxbytes);
if (nr_pages > ARRAY_SIZE(pages_onstack)) if (nr_pages > ARRAY_SIZE(pages_onstack))
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册