Page MenuHomeFreeBSD

cuse: Fix hang on readv(2) and writev(2) with multiple iovecs
AcceptedPublic

Authored by christos on Fri, Sep 18, 7:42 PM.
Tags
None
Referenced Files
F172516062: D59822.id187141.diff
Fri, Sep 18, 11:50 PM
F172515457: D59822.diff
Fri, Sep 18, 11:43 PM
F172510261: D59822.diff
Fri, Sep 18, 10:56 PM
F172507610: D59822.diff
Fri, Sep 18, 10:34 PM
F172495364: D59822.diff
Fri, Sep 18, 8:48 PM
Subscribers

Details

Summary

uiomove() leaves an iovec it has just emptied as the current one, so
cuse_client_read() and cuse_client_write() picked it up again on the
next iteration, sent the server a zero-length command, and got zero
bytes back. That left the residual count unchanged, so the loop never
terminated and the call never returned.

Step past empty iovecs at the start of every iteration. This also covers
caller-supplied zero-length iovecs, which hung in the same way

PR: 293489
MFC after: 1 week
Sponsored by: The FreeBSD Foundation

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 77067
Build 73950: arc lint + arc unit

Event Timeline

This also means that we won't forward actual zero-length iov entries to the server. I don't know why a server would care though.

This revision is now accepted and ready to land.Fri, Sep 18, 9:04 PM
kib added inline comments.
sys/fs/cuse/cuse.c
1683

I would move the read of 'len' before two checks, and use the local for '== 0' and '> CUSE_LENGHT_MAX' comparisons.

1781

Same there.