| Message ID | 20211029122359.1.I1e23f382fbd8beb19fe1c06d70798b292012c57a@changeid (mailing list archive) |
|---|---|
| State | Mainlined, archived |
| Headers | show |
| Series | PM / hibernate: Fix snapshot partial write lengths | expand |
Gentle bump. On Fri, Oct 29, 2021 at 12:24 PM Evan Green <evgreen@chromium.org> wrote: > > snapshot_write() is inappropriately limiting the amount of data that can > be written in cases where a partial page has already been written. For > example, one would expect to be able to write 1 byte, then 4095 bytes to > the snapshot device, and have both of those complete fully (since now > we're aligned to a page again). But what ends up happening is we write 1 > byte, then 4094/4095 bytes complete successfully. > > The reason is that simple_write_to_buffer()'s second argument is the > total size of the buffer, not the size of the buffer minus the offset. > Since simple_write_to_buffer() accounts for the offset in its > implementation, snapshot_write() can just pass the full page size > directly down. > > Signed-off-by: Evan Green <evgreen@chromium.org> > --- > > kernel/power/user.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/power/user.c b/kernel/power/user.c > index 740723bb388524..ad241b4ff64c58 100644 > --- a/kernel/power/user.c > +++ b/kernel/power/user.c > @@ -177,7 +177,7 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, > if (res <= 0) > goto unlock; > } else { > - res = PAGE_SIZE - pg_offp; > + res = PAGE_SIZE; > } > > if (!data_of(data->handle)) { > -- > 2.31.0 >
On Mon, Nov 15, 2021 at 6:13 PM Evan Green <evgreen@chromium.org> wrote: > > Gentle bump. > > > On Fri, Oct 29, 2021 at 12:24 PM Evan Green <evgreen@chromium.org> wrote: > > > > snapshot_write() is inappropriately limiting the amount of data that can > > be written in cases where a partial page has already been written. For > > example, one would expect to be able to write 1 byte, then 4095 bytes to > > the snapshot device, and have both of those complete fully (since now > > we're aligned to a page again). But what ends up happening is we write 1 > > byte, then 4094/4095 bytes complete successfully. > > > > The reason is that simple_write_to_buffer()'s second argument is the > > total size of the buffer, not the size of the buffer minus the offset. > > Since simple_write_to_buffer() accounts for the offset in its > > implementation, snapshot_write() can just pass the full page size > > directly down. > > > > Signed-off-by: Evan Green <evgreen@chromium.org> > > --- > > > > kernel/power/user.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/kernel/power/user.c b/kernel/power/user.c > > index 740723bb388524..ad241b4ff64c58 100644 > > --- a/kernel/power/user.c > > +++ b/kernel/power/user.c > > @@ -177,7 +177,7 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, > > if (res <= 0) > > goto unlock; > > } else { > > - res = PAGE_SIZE - pg_offp; > > + res = PAGE_SIZE; > > } > > > > if (!data_of(data->handle)) { > > -- Do you actually see this problem in practice?
On Tue, Nov 16, 2021 at 9:54 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > On Mon, Nov 15, 2021 at 6:13 PM Evan Green <evgreen@chromium.org> wrote: > > > > Gentle bump. > > > > > > On Fri, Oct 29, 2021 at 12:24 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > snapshot_write() is inappropriately limiting the amount of data that can > > > be written in cases where a partial page has already been written. For > > > example, one would expect to be able to write 1 byte, then 4095 bytes to > > > the snapshot device, and have both of those complete fully (since now > > > we're aligned to a page again). But what ends up happening is we write 1 > > > byte, then 4094/4095 bytes complete successfully. > > > > > > The reason is that simple_write_to_buffer()'s second argument is the > > > total size of the buffer, not the size of the buffer minus the offset. > > > Since simple_write_to_buffer() accounts for the offset in its > > > implementation, snapshot_write() can just pass the full page size > > > directly down. > > > > > > Signed-off-by: Evan Green <evgreen@chromium.org> > > > --- > > > > > > kernel/power/user.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/kernel/power/user.c b/kernel/power/user.c > > > index 740723bb388524..ad241b4ff64c58 100644 > > > --- a/kernel/power/user.c > > > +++ b/kernel/power/user.c > > > @@ -177,7 +177,7 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, > > > if (res <= 0) > > > goto unlock; > > > } else { > > > - res = PAGE_SIZE - pg_offp; > > > + res = PAGE_SIZE; > > > } > > > > > > if (!data_of(data->handle)) { > > > -- > > Do you actually see this problem in practice? Yes. I may fire up another thread to explain why I'm stuck doing a partial page write, and how I might be able to stop doing that in the future with some kernel help. But either way, this is a bug. -Evan
On Tue, Nov 16, 2021 at 9:22 PM Evan Green <evgreen@chromium.org> wrote: > > On Tue, Nov 16, 2021 at 9:54 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > > > On Mon, Nov 15, 2021 at 6:13 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > Gentle bump. > > > > > > > > > On Fri, Oct 29, 2021 at 12:24 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > > > snapshot_write() is inappropriately limiting the amount of data that can > > > > be written in cases where a partial page has already been written. For > > > > example, one would expect to be able to write 1 byte, then 4095 bytes to > > > > the snapshot device, and have both of those complete fully (since now > > > > we're aligned to a page again). But what ends up happening is we write 1 > > > > byte, then 4094/4095 bytes complete successfully. > > > > > > > > The reason is that simple_write_to_buffer()'s second argument is the > > > > total size of the buffer, not the size of the buffer minus the offset. > > > > Since simple_write_to_buffer() accounts for the offset in its > > > > implementation, snapshot_write() can just pass the full page size > > > > directly down. > > > > > > > > Signed-off-by: Evan Green <evgreen@chromium.org> > > > > --- > > > > > > > > kernel/power/user.c | 2 +- > > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > > > diff --git a/kernel/power/user.c b/kernel/power/user.c > > > > index 740723bb388524..ad241b4ff64c58 100644 > > > > --- a/kernel/power/user.c > > > > +++ b/kernel/power/user.c > > > > @@ -177,7 +177,7 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, > > > > if (res <= 0) > > > > goto unlock; > > > > } else { > > > > - res = PAGE_SIZE - pg_offp; > > > > + res = PAGE_SIZE; > > > > } > > > > > > > > if (!data_of(data->handle)) { > > > > -- > > > > Do you actually see this problem in practice? > > Yes. I may fire up another thread to explain why I'm stuck doing a > partial page write, and how I might be able to stop doing that in the > future with some kernel help. But either way, this is a bug. OK, patch applied as 5.16-rc material. I guess it should go into -stable kernels too?
On Wed, Nov 24, 2021 at 4:54 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > On Tue, Nov 16, 2021 at 9:22 PM Evan Green <evgreen@chromium.org> wrote: > > > > On Tue, Nov 16, 2021 at 9:54 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > > > > > On Mon, Nov 15, 2021 at 6:13 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > > > Gentle bump. > > > > > > > > > > > > On Fri, Oct 29, 2021 at 12:24 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > > > > > snapshot_write() is inappropriately limiting the amount of data that can > > > > > be written in cases where a partial page has already been written. For > > > > > example, one would expect to be able to write 1 byte, then 4095 bytes to > > > > > the snapshot device, and have both of those complete fully (since now > > > > > we're aligned to a page again). But what ends up happening is we write 1 > > > > > byte, then 4094/4095 bytes complete successfully. > > > > > > > > > > The reason is that simple_write_to_buffer()'s second argument is the > > > > > total size of the buffer, not the size of the buffer minus the offset. > > > > > Since simple_write_to_buffer() accounts for the offset in its > > > > > implementation, snapshot_write() can just pass the full page size > > > > > directly down. > > > > > > > > > > Signed-off-by: Evan Green <evgreen@chromium.org> > > > > > --- > > > > > > > > > > kernel/power/user.c | 2 +- > > > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > > > > > diff --git a/kernel/power/user.c b/kernel/power/user.c > > > > > index 740723bb388524..ad241b4ff64c58 100644 > > > > > --- a/kernel/power/user.c > > > > > +++ b/kernel/power/user.c > > > > > @@ -177,7 +177,7 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, > > > > > if (res <= 0) > > > > > goto unlock; > > > > > } else { > > > > > - res = PAGE_SIZE - pg_offp; > > > > > + res = PAGE_SIZE; > > > > > } > > > > > > > > > > if (!data_of(data->handle)) { > > > > > -- > > > > > > Do you actually see this problem in practice? > > > > Yes. I may fire up another thread to explain why I'm stuck doing a > > partial page write, and how I might be able to stop doing that in the > > future with some kernel help. But either way, this is a bug. > > OK, patch applied as 5.16-rc material. > > I guess it should go into -stable kernels too? Yes, putting it into -stable would make sense also. I should have CCed them originally, doing that now. -Evan
On Mon, Nov 29, 2021 at 08:50:06AM -0800, Evan Green wrote: > On Wed, Nov 24, 2021 at 4:54 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > > > On Tue, Nov 16, 2021 at 9:22 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > On Tue, Nov 16, 2021 at 9:54 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > > > > > > > On Mon, Nov 15, 2021 at 6:13 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > > > > > Gentle bump. > > > > > > > > > > > > > > > On Fri, Oct 29, 2021 at 12:24 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > > > > > > > snapshot_write() is inappropriately limiting the amount of data that can > > > > > > be written in cases where a partial page has already been written. For > > > > > > example, one would expect to be able to write 1 byte, then 4095 bytes to > > > > > > the snapshot device, and have both of those complete fully (since now > > > > > > we're aligned to a page again). But what ends up happening is we write 1 > > > > > > byte, then 4094/4095 bytes complete successfully. > > > > > > > > > > > > The reason is that simple_write_to_buffer()'s second argument is the > > > > > > total size of the buffer, not the size of the buffer minus the offset. > > > > > > Since simple_write_to_buffer() accounts for the offset in its > > > > > > implementation, snapshot_write() can just pass the full page size > > > > > > directly down. > > > > > > > > > > > > Signed-off-by: Evan Green <evgreen@chromium.org> > > > > > > --- > > > > > > > > > > > > kernel/power/user.c | 2 +- > > > > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > > > > > > > diff --git a/kernel/power/user.c b/kernel/power/user.c > > > > > > index 740723bb388524..ad241b4ff64c58 100644 > > > > > > --- a/kernel/power/user.c > > > > > > +++ b/kernel/power/user.c > > > > > > @@ -177,7 +177,7 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, > > > > > > if (res <= 0) > > > > > > goto unlock; > > > > > > } else { > > > > > > - res = PAGE_SIZE - pg_offp; > > > > > > + res = PAGE_SIZE; > > > > > > } > > > > > > > > > > > > if (!data_of(data->handle)) { > > > > > > -- > > > > > > > > Do you actually see this problem in practice? > > > > > > Yes. I may fire up another thread to explain why I'm stuck doing a > > > partial page write, and how I might be able to stop doing that in the > > > future with some kernel help. But either way, this is a bug. > > > > OK, patch applied as 5.16-rc material. > > > > I guess it should go into -stable kernels too? > > Yes, putting it into -stable would make sense also. I should have CCed > them originally, doing that now. <formletter> This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read: https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html for how to do this properly. </formletter>
On Mon, Nov 29, 2021 at 5:50 PM Evan Green <evgreen@chromium.org> wrote: > > On Wed, Nov 24, 2021 at 4:54 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > > > On Tue, Nov 16, 2021 at 9:22 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > On Tue, Nov 16, 2021 at 9:54 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > > > > > > > On Mon, Nov 15, 2021 at 6:13 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > > > > > Gentle bump. > > > > > > > > > > > > > > > On Fri, Oct 29, 2021 at 12:24 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > > > > > > > snapshot_write() is inappropriately limiting the amount of data that can > > > > > > be written in cases where a partial page has already been written. For > > > > > > example, one would expect to be able to write 1 byte, then 4095 bytes to > > > > > > the snapshot device, and have both of those complete fully (since now > > > > > > we're aligned to a page again). But what ends up happening is we write 1 > > > > > > byte, then 4094/4095 bytes complete successfully. > > > > > > > > > > > > The reason is that simple_write_to_buffer()'s second argument is the > > > > > > total size of the buffer, not the size of the buffer minus the offset. > > > > > > Since simple_write_to_buffer() accounts for the offset in its > > > > > > implementation, snapshot_write() can just pass the full page size > > > > > > directly down. > > > > > > > > > > > > Signed-off-by: Evan Green <evgreen@chromium.org> > > > > > > --- > > > > > > > > > > > > kernel/power/user.c | 2 +- > > > > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > > > > > > > diff --git a/kernel/power/user.c b/kernel/power/user.c > > > > > > index 740723bb388524..ad241b4ff64c58 100644 > > > > > > --- a/kernel/power/user.c > > > > > > +++ b/kernel/power/user.c > > > > > > @@ -177,7 +177,7 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, > > > > > > if (res <= 0) > > > > > > goto unlock; > > > > > > } else { > > > > > > - res = PAGE_SIZE - pg_offp; > > > > > > + res = PAGE_SIZE; > > > > > > } > > > > > > > > > > > > if (!data_of(data->handle)) { > > > > > > -- > > > > > > > > Do you actually see this problem in practice? > > > > > > Yes. I may fire up another thread to explain why I'm stuck doing a > > > partial page write, and how I might be able to stop doing that in the > > > future with some kernel help. But either way, this is a bug. > > > > OK, patch applied as 5.16-rc material. > > > > I guess it should go into -stable kernels too? > > Yes, putting it into -stable would make sense also. I should have CCed > them originally, doing that now. Well, you need to point them to the upstream commit to backport. In this particular case it would be commit 88a5045f176b78c33a269a30a7b146e99c550bd9 (pm-sleep) Author: Evan Green <evgreen@chromium.org> Date: Fri Oct 29 12:24:22 2021 -0700 PM: hibernate: Fix snapshot partial write lengths I'll send an inclusion request for this. I guess it should go into all of the applicable -stable series, right?
On Tue, Nov 30, 2021 at 3:46 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > On Mon, Nov 29, 2021 at 5:50 PM Evan Green <evgreen@chromium.org> wrote: > > > > On Wed, Nov 24, 2021 at 4:54 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > > > > > On Tue, Nov 16, 2021 at 9:22 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > > > On Tue, Nov 16, 2021 at 9:54 AM Rafael J. Wysocki <rafael@kernel.org> wrote: > > > > > > > > > > On Mon, Nov 15, 2021 at 6:13 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > > > > > > > Gentle bump. > > > > > > > > > > > > > > > > > > On Fri, Oct 29, 2021 at 12:24 PM Evan Green <evgreen@chromium.org> wrote: > > > > > > > > > > > > > > snapshot_write() is inappropriately limiting the amount of data that can > > > > > > > be written in cases where a partial page has already been written. For > > > > > > > example, one would expect to be able to write 1 byte, then 4095 bytes to > > > > > > > the snapshot device, and have both of those complete fully (since now > > > > > > > we're aligned to a page again). But what ends up happening is we write 1 > > > > > > > byte, then 4094/4095 bytes complete successfully. > > > > > > > > > > > > > > The reason is that simple_write_to_buffer()'s second argument is the > > > > > > > total size of the buffer, not the size of the buffer minus the offset. > > > > > > > Since simple_write_to_buffer() accounts for the offset in its > > > > > > > implementation, snapshot_write() can just pass the full page size > > > > > > > directly down. > > > > > > > > > > > > > > Signed-off-by: Evan Green <evgreen@chromium.org> > > > > > > > --- > > > > > > > > > > > > > > kernel/power/user.c | 2 +- > > > > > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > > > > > > > > > diff --git a/kernel/power/user.c b/kernel/power/user.c > > > > > > > index 740723bb388524..ad241b4ff64c58 100644 > > > > > > > --- a/kernel/power/user.c > > > > > > > +++ b/kernel/power/user.c > > > > > > > @@ -177,7 +177,7 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, > > > > > > > if (res <= 0) > > > > > > > goto unlock; > > > > > > > } else { > > > > > > > - res = PAGE_SIZE - pg_offp; > > > > > > > + res = PAGE_SIZE; > > > > > > > } > > > > > > > > > > > > > > if (!data_of(data->handle)) { > > > > > > > -- > > > > > > > > > > Do you actually see this problem in practice? > > > > > > > > Yes. I may fire up another thread to explain why I'm stuck doing a > > > > partial page write, and how I might be able to stop doing that in the > > > > future with some kernel help. But either way, this is a bug. > > > > > > OK, patch applied as 5.16-rc material. > > > > > > I guess it should go into -stable kernels too? > > > > Yes, putting it into -stable would make sense also. I should have CCed > > them originally, doing that now. > > Well, you need to point them to the upstream commit to backport. > > In this particular case it would be > > commit 88a5045f176b78c33a269a30a7b146e99c550bd9 (pm-sleep) > Author: Evan Green <evgreen@chromium.org> > Date: Fri Oct 29 12:24:22 2021 -0700 > > PM: hibernate: Fix snapshot partial write lengths > > I'll send an inclusion request for this. I guess it should go into > all of the applicable -stable series, right? Correct. From what I can tell this code and simple_write_to_buffer() haven't changed since its introduction in 2010, so my patch should have had a fixes tag like: Fixes: d3c1b24c50e8 ("PM / Hibernate: Snapshot cleanup") Thanks for doing that Rafael, sorry for flubbing the stable aspect. -Evan
diff --git a/kernel/power/user.c b/kernel/power/user.c index 740723bb388524..ad241b4ff64c58 100644 --- a/kernel/power/user.c +++ b/kernel/power/user.c @@ -177,7 +177,7 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, if (res <= 0) goto unlock; } else { - res = PAGE_SIZE - pg_offp; + res = PAGE_SIZE; } if (!data_of(data->handle)) {
snapshot_write() is inappropriately limiting the amount of data that can be written in cases where a partial page has already been written. For example, one would expect to be able to write 1 byte, then 4095 bytes to the snapshot device, and have both of those complete fully (since now we're aligned to a page again). But what ends up happening is we write 1 byte, then 4094/4095 bytes complete successfully. The reason is that simple_write_to_buffer()'s second argument is the total size of the buffer, not the size of the buffer minus the offset. Since simple_write_to_buffer() accounts for the offset in its implementation, snapshot_write() can just pass the full page size directly down. Signed-off-by: Evan Green <evgreen@chromium.org> --- kernel/power/user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)