sendfile/splice-related kernel NULL pointer dereference in zpl_iter_read+0x150/0x1a0 #11375
Labels
Type: Defect
Incorrect behavior (e.g. crash, hang)
Comments
softminus
added
Status: Triage Needed
|
Oh and if it is relevant, i have a single zpool consisting of a single mirror vdev, composed of one 1TB NVMe SSD and one 1TB SATA SSD. |
|
Thanks for reporting this. I was able to reproduce the issue and will investigate. |
13 tasks
behlendorf
added a commit
that referenced
this issue
Dec 23, 2020
There's no need to call iov_iter_advance() in zpl_iter_read(). This was preserved from the previous code where it wasn't needed but also didn't cause any problems. Now that the iter functions also handle pipes that's no longer the case. When fully reading a pipe buffer iov_iter_advance() may results in the pipe buf release function being called which will not be registered resulting in a NULL dereference. Signed-off-by: Brian Behlendorf <[email protected]> Closes #11375 Closes #11378
|
Did this make it into 2.0.1? |
|
Yes. This fix was included in 2.0.1. |
jsai20
pushed a commit
to jsai20/zfs
that referenced
this issue
Mar 30, 2021
There's no need to call iov_iter_advance() in zpl_iter_read(). This was preserved from the previous code where it wasn't needed but also didn't cause any problems. Now that the iter functions also handle pipes that's no longer the case. When fully reading a pipe buffer iov_iter_advance() may results in the pipe buf release function being called which will not be registered resulting in a NULL dereference. Signed-off-by: Brian Behlendorf <[email protected]> Closes openzfs#11375 Closes openzfs#11378
sempervictus
pushed a commit
to sempervictus/zfs
that referenced
this issue
May 31, 2021
There's no need to call iov_iter_advance() in zpl_iter_read(). This was preserved from the previous code where it wasn't needed but also didn't cause any problems. Now that the iter functions also handle pipes that's no longer the case. When fully reading a pipe buffer iov_iter_advance() may results in the pipe buf release function being called which will not be registered resulting in a NULL dereference. Signed-off-by: Brian Behlendorf <[email protected]> Closes openzfs#11375 Closes openzfs#11378
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
System information
Describe the problem you're observing
pip install --user --upgrade git+https://github.com/nmigen/nmigen.git reliably fails and causes this to show up in dmesg:
Describe how to reproduce the problem
use above versions of linux and zfs, invoke that pip command (which i think invokes sendfile/splice), and it fails and dumps the messages below in the dmesg.
Include any warning/errors/backtraces from the system logs
The text was updated successfully, but these errors were encountered: