Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <CAJfpegv-EQhvJUB0AUhJ=Xx8moHHQvkDGe-yUXHENyWvboBU3A@mail.gmail.com>
 <1b09a159-bcec-63c9-df42-47d99f44d445@virtuozzo.com>
In-Reply-To: <1b09a159-bcec-63c9-df42-47d99f44d445@virtuozzo.com>
From:   Miklos Szeredi <miklos@szeredi.hu>
Date:   Thu, 3 Oct 2019 10:04:22 +0200
Message-ID: <CAJfpegvcef_rJ5VHdE91LAU2_=XrorsTZu_7JCPsJFo0aGwZmw@mail.gmail.com>
Subject: Re: [PATCH] fuse: BUG_ON correction in fuse_dev_splice_write()
To:     Vasily Averin <vvs@virtuozzo.com>
Cc:     linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        Andrey Ryabinin <aryabinin@virtuozzo.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Aug 19, 2019 at 8:53 AM Vasily Averin <vvs@virtuozzo.com> wrote:
>
> commit 963545357202 ("fuse: reduce allocation size for splice_write")
> changed size of bufs array, so BUG_ON which checks the index of the array
> shold also be fixed.
>
> Fixes: 963545357202 ("fuse: reduce allocation size for splice_write")
> Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
> ---
>  fs/fuse/dev.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
> index ea8237513dfa..f4ef6e01642c 100644
> --- a/fs/fuse/dev.c
> +++ b/fs/fuse/dev.c
> @@ -2029,7 +2029,7 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
>                                      struct file *out, loff_t *ppos,
>                                      size_t len, unsigned int flags)
>  {
> -       unsigned nbuf;
> +       unsigned nbuf, bsize;
>         unsigned idx;
>         struct pipe_buffer *bufs;
>         struct fuse_copy_state cs;
> @@ -2043,7 +2043,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
>
>         pipe_lock(pipe);
>
> -       bufs = kvmalloc_array(pipe->nrbufs, sizeof(struct pipe_buffer),
> +       bsize = pipe->nrbufs;
> +       bufs = kvmalloc_array(bsize, sizeof(struct pipe_buffer),
>                               GFP_KERNEL);
>         if (!bufs) {
>                 pipe_unlock(pipe);
> @@ -2064,7 +2065,7 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
>                 struct pipe_buffer *ibuf;
>                 struct pipe_buffer *obuf;
>
> -               BUG_ON(nbuf >= pipe->buffers);
> +               BUG_ON(nbuf >= bsize);
>                 BUG_ON(!pipe->nrbufs);

Better turn these into WARN_ON's..  Fixed and applied.

Thanks,
Miklos