Differential D59822

cuse: Fix hang on readv(2) and writev(2) with multiple iovecs
AcceptedPublic
Actions

Authored by christos on Fri, Sep 18, 7:42 PM.

Tags

None

Referenced Files

	F172516062: D59822.id187141.diff
	Fri, Sep 18, 11:50 PM

	F172515457: D59822.diff
	Fri, Sep 18, 11:43 PM

	F172510261: D59822.diff
	Fri, Sep 18, 10:56 PM

	F172507610: D59822.diff
	Fri, Sep 18, 10:34 PM

	F172495364: D59822.diff
	Fri, Sep 18, 8:48 PM

Subscribers

Details

Reviewers

markj
kib
emaste
bnovkov

Summary

uiomove() leaves an iovec it has just emptied as the current one, so
cuse_client_read() and cuse_client_write() picked it up again on the
next iteration, sent the server a zero-length command, and got zero
bytes back. That left the residual count unchanged, so the loop never
terminated and the call never returned.

Step past empty iovecs at the start of every iteration. This also covers
caller-supplied zero-length iovecs, which hung in the same way

PR: 293489
MFC after: 1 week
Sponsored by: The FreeBSD Foundation

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 77067
Build 73950: arc lint + arc unit

Event Timeline

christos created this revision.Fri, Sep 18, 7:42 PM

Herald added a subscriber: imp. · View Herald TranscriptFri, Sep 18, 7:42 PM

christos requested review of this revision.Fri, Sep 18, 7:42 PM

Harbormaster completed remote builds in B77067: Diff 187141.Fri, Sep 18, 7:42 PM

This also means that we won't forward actual zero-length iov entries to the server. I don't know why a server would care though.

This revision is now accepted and ready to land.Fri, Sep 18, 9:04 PM

kib accepted this revision.Sat, Sep 19, 1:21 AM

kib added inline comments.

sys/fs/cuse/cuse.c
1683	I would move the read of 'len' before two checks, and use the local for '== 0' and '> CUSE_LENGHT_MAX' comparisons.
1781	Same there.

Revision Contents
Changeset List

Path

Size

sys/

fs/

cuse/

20 lines

Diff 187141

sys/fs/cuse/cuse.c

Loading...