If read() is done in an unbuffered manner, such that, say,
cifs_strict_readv() goes through cifs_user_readv() and thence
__cifs_readv(), it doesn't recognise the EOF and keeps indicating to
userspace that it returning full buffers of data.
This is due to ctx->iter being advanced in cifs_send_async_read() as the
buffer is split up amongst a number of rdata objects. The iterator count
is then used in collect_uncached_read_data() in the non-DIO case to set the
total length read - and thus the return value of sys_read(). But since the
iterator normally gets used up completely during splitting, ctx->total_len
gets overridden to the full amount.
However, prior to that in collect_uncached_read_data(), we've gone through
the list of rdatas and added up the amount of data we actually received
(which we then throw away).
Fix this by removing the bit that overrides the amount read in the non-DIO
case and just going with the total added up in the aforementioned loop.
This was observed by mounting a cifs share with multiple channels, e.g.:
mount //192.168.6.1/test /test/ -o user=shares,pass=...,max_channels=6
and then reading a 1MiB file on the share:
strace cat /xfstest.test/1M >/dev/null
Through strace, the same data can be seen being read again and again.
Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
Signed-off-by: David Howells <[email protected]>
cc: Steve French <[email protected]>
cc: Paulo Alcantara <[email protected]>
cc: Jérôme Glisse <[email protected]>
cc: Long Li <[email protected]>
cc: Enzo Matsumiya <[email protected]>
cc: Shyam Prasad N <[email protected]>
cc: Rohith Surabattula <[email protected]>
cc: Jeff Layton <[email protected]>
cc: [email protected]
---
fs/cifs/file.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 321f9b7c84c9..f8877dc91cc5 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -4010,7 +4010,6 @@ static void
collect_uncached_read_data(struct cifs_aio_ctx *ctx)
{
struct cifs_readdata *rdata, *tmp;
- struct iov_iter *to = &ctx->iter;
struct cifs_sb_info *cifs_sb;
int rc;
@@ -4076,9 +4075,6 @@ collect_uncached_read_data(struct cifs_aio_ctx *ctx)
kref_put(&rdata->refcount, cifs_readdata_release);
}
- if (!ctx->direct_io)
- ctx->total_len = ctx->len - iov_iter_count(to);
-
/* mask nodata case */
if (rc == -ENODATA)
rc = 0;
David Howells <[email protected]> writes:
> If read() is done in an unbuffered manner, such that, say,
> cifs_strict_readv() goes through cifs_user_readv() and thence
> __cifs_readv(), it doesn't recognise the EOF and keeps indicating to
> userspace that it returning full buffers of data.
>
> This is due to ctx->iter being advanced in cifs_send_async_read() as the
> buffer is split up amongst a number of rdata objects. The iterator count
> is then used in collect_uncached_read_data() in the non-DIO case to set the
> total length read - and thus the return value of sys_read(). But since the
> iterator normally gets used up completely during splitting, ctx->total_len
> gets overridden to the full amount.
>
> However, prior to that in collect_uncached_read_data(), we've gone through
> the list of rdatas and added up the amount of data we actually received
> (which we then throw away).
>
> Fix this by removing the bit that overrides the amount read in the non-DIO
> case and just going with the total added up in the aforementioned loop.
>
> This was observed by mounting a cifs share with multiple channels, e.g.:
>
> mount //192.168.6.1/test /test/ -o user=shares,pass=...,max_channels=6
>
> and then reading a 1MiB file on the share:
>
> strace cat /xfstest.test/1M >/dev/null
>
> Through strace, the same data can be seen being read again and again.
>
> Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
> Signed-off-by: David Howells <[email protected]>
> cc: Steve French <[email protected]>
> cc: Paulo Alcantara <[email protected]>
> cc: Jérôme Glisse <[email protected]>
> cc: Long Li <[email protected]>
> cc: Enzo Matsumiya <[email protected]>
> cc: Shyam Prasad N <[email protected]>
> cc: Rohith Surabattula <[email protected]>
> cc: Jeff Layton <[email protected]>
> cc: [email protected]
> ---
> fs/cifs/file.c | 4 ----
> 1 file changed, 4 deletions(-)
Acked-by: Paulo Alcantara (SUSE) <[email protected]>
Updated to add Paulo's Acked-by and also attached the other fix. Let
me know if any additional feedback/review/testing results
cifs: Reapply lost fix from commit 30b2b2196d6e
Reapply the fix from
30b2b2196d6e ("cifs: do not include page data when checking signature")
that got lost in the iteratorisation of the cifs driver.
On Tue, Apr 18, 2023 at 5:40 PM David Howells <[email protected]> wrote:
>
>
> If read() is done in an unbuffered manner, such that, say,
> cifs_strict_readv() goes through cifs_user_readv() and thence
> __cifs_readv(), it doesn't recognise the EOF and keeps indicating to
> userspace that it returning full buffers of data.
>
> This is due to ctx->iter being advanced in cifs_send_async_read() as the
> buffer is split up amongst a number of rdata objects. The iterator count
> is then used in collect_uncached_read_data() in the non-DIO case to set the
> total length read - and thus the return value of sys_read(). But since the
> iterator normally gets used up completely during splitting, ctx->total_len
> gets overridden to the full amount.
>
> However, prior to that in collect_uncached_read_data(), we've gone through
> the list of rdatas and added up the amount of data we actually received
> (which we then throw away).
>
> Fix this by removing the bit that overrides the amount read in the non-DIO
> case and just going with the total added up in the aforementioned loop.
>
> This was observed by mounting a cifs share with multiple channels, e.g.:
>
> mount //192.168.6.1/test /test/ -o user=shares,pass=...,max_channels=6
>
> and then reading a 1MiB file on the share:
>
> strace cat /xfstest.test/1M >/dev/null
>
> Through strace, the same data can be seen being read again and again.
>
> Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
> Signed-off-by: David Howells <[email protected]>
> cc: Steve French <[email protected]>
> cc: Paulo Alcantara <[email protected]>
> cc: Jérôme Glisse <[email protected]>
> cc: Long Li <[email protected]>
> cc: Enzo Matsumiya <[email protected]>
> cc: Shyam Prasad N <[email protected]>
> cc: Rohith Surabattula <[email protected]>
> cc: Jeff Layton <[email protected]>
> cc: [email protected]
> ---
> fs/cifs/file.c | 4 ----
> 1 file changed, 4 deletions(-)
>
> diff --git a/fs/cifs/file.c b/fs/cifs/file.c
> index 321f9b7c84c9..f8877dc91cc5 100644
> --- a/fs/cifs/file.c
> +++ b/fs/cifs/file.c
> @@ -4010,7 +4010,6 @@ static void
> collect_uncached_read_data(struct cifs_aio_ctx *ctx)
> {
> struct cifs_readdata *rdata, *tmp;
> - struct iov_iter *to = &ctx->iter;
> struct cifs_sb_info *cifs_sb;
> int rc;
>
> @@ -4076,9 +4075,6 @@ collect_uncached_read_data(struct cifs_aio_ctx *ctx)
> kref_put(&rdata->refcount, cifs_readdata_release);
> }
>
> - if (!ctx->direct_io)
> - ctx->total_len = ctx->len - iov_iter_count(to);
> -
> /* mask nodata case */
> if (rc == -ENODATA)
> rc = 0;
>
--
Thanks,
Steve