fs: possible deadlock in do_iter_write/do_splice

Commit Message

Al Viro July 6, 2017, 1:18 p.m. UTC

On Thu, Jul 06, 2017 at 03:01:11PM +0200, Andrey Konovalov wrote:
> Hi,
> 
> I've got the following error report while fuzzing the kernel with syzkaller.
> 
> On commit 9b51f04424e17051a89ab32d892ca66b2a104825 (4.12+).

It's "fs: implement vfs_iter_write using do_iter_write", actually.

vfs_iter_write() has no business playing with file_start_write(); do_iter_write()
does.  

commit 62473a2d6f513296e896b64ccfd7ceb7b963795e
Author: Al Viro <[e-mail]>
Date:   Thu Jul 6 09:15:47 2017 -0400

    move file_{start,end}_write() out of do_iter_write()
    
    ... and do *not* grab it in vfs_write_iter().
    
    Fixes: "fs: implement vfs_iter_read using do_iter_read"
    Signed-off-by: Al Viro <[e-mail]>

Patch

diff --git a/fs/read_write.c b/fs/read_write.c
index acfd3dc63d57..be1125b30aec 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -931,12 +931,10 @@  static ssize_t do_iter_write(struct file *file, struct iov_iter *iter,
 	if (ret < 0)
 		return ret;
 
-	file_start_write(file);
 	if (file->f_op->write_iter)
 		ret = do_iter_readv_writev(file, iter, pos, WRITE, flags);
 	else
 		ret = do_loop_readv_writev(file, iter, pos, WRITE, flags);
-	file_end_write(file);
 	if (ret > 0)
 		fsnotify_modify(file);
 	return ret;
@@ -979,7 +977,9 @@  ssize_t vfs_writev(struct file *file, const struct iovec __user *vec,
 
 	ret = import_iovec(WRITE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
 	if (ret >= 0) {
+		file_start_write(file);
 		ret = do_iter_write(file, &iter, pos, flags);
+		file_end_write(file);
 		kfree(iov);
 	}
 	return ret;
@@ -1247,7 +1247,9 @@  static size_t compat_writev(struct file *file,
 
 	ret = compat_import_iovec(WRITE, vec, vlen, UIO_FASTIOV, &iov, &iter);
 	if (ret >= 0) {
+		file_start_write(file);
 		ret = do_iter_write(file, &iter, pos, flags);
+		file_end_write(file);
 		kfree(iov);
 	}
 	if (ret > 0)