Page MenuHomeFreeBSD

cuse: Fix hang on readv(2) and writev(2) with multiple iovecs
ClosedPublic

Authored by christos on Fri, Sep 18, 7:42 PM.
Tags
None
Referenced Files
F176162142: D59822.diff
Fri, Oct 16, 2:27 PM
Unknown Object (File)
Wed, Oct 14, 12:30 PM
Unknown Object (File)
Tue, Oct 13, 8:24 PM
Unknown Object (File)
Sat, Oct 10, 4:02 AM
Unknown Object (File)
Wed, Oct 7, 2:28 PM
Unknown Object (File)
Wed, Oct 7, 9:08 AM
Unknown Object (File)
Wed, Oct 7, 6:18 AM
Unknown Object (File)
Wed, Oct 7, 2:31 AM
Subscribers

Details

Summary

uiomove() leaves an iovec it has just emptied as the current one, so
cuse_client_read() and cuse_client_write() picked it up again on the
next iteration, sent the server a zero-length command, and got zero
bytes back. That left the residual count unchanged, so the loop never
terminated and the call never returned.

Step past empty iovecs at the start of every iteration. This also covers
caller-supplied zero-length iovecs, which hung in the same way

PR: 293489
MFC after: 1 week
Sponsored by: The FreeBSD Foundation

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This also means that we won't forward actual zero-length iov entries to the server. I don't know why a server would care though.

This revision is now accepted and ready to land.Fri, Sep 18, 9:04 PM
kib added inline comments.
sys/fs/cuse/cuse.c
1683–1684

I would move the read of 'len' before two checks, and use the local for '== 0' and '> CUSE_LENGHT_MAX' comparisons.

1781–1782

Same there.