Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <2076817.1675434996@warthog.procyon.org.uk>
References: <2076817.1675434996@warthog.procyon.org.uk> <72029a93-1150-1994-916f-b15ef0befd49@nvidia.com> <e8065d6a-d2f9-60aa-8541-8dfc8e9b608f@redhat.com> <000000000000b0b3c005f3a09383@google.com> <822863.1675327935@warthog.procyon.org.uk> <1265629.1675350909@warthog.procyon.org.uk>
To:     John Hubbard <jhubbard@nvidia.com>
Cc:     dhowells@redhat.com, David Hildenbrand <david@redhat.com>,
        syzbot <syzbot+a440341a59e3b7142895@syzkaller.appspotmail.com>,
        hch@lst.de, linux-kernel@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] general protection fault in skb_dequeue (3)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2116766.1675441821.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Fri, 03 Feb 2023 16:30:21 +0000
Message-ID: <2116767.1675441821@warthog.procyon.org.uk>
Precedence: bulk

David Howells <dhowells@redhat.com> wrote:

> I think I have managed to isolate the bug to the read side of sendfile()=
 or
> the pipe in the middle by the following:
> =

> In iter_file_splice_write(), I allocate a permanent page:
> ...
> and then stick it into the BVEC iter to be handed over to vfs_iter_write=
()
> instead of buf->page:
> =

> -			array[n].bv_page =3D buf->page;
> +			array[n].bv_page =3D splice_tmp;
> +			trace_page_ref_set(splice_tmp, 887);
>  			array[n].bv_len =3D this_len;
>  			array[n].bv_offset =3D buf->offset;
> =

> that prevents vfs_iter_write() from ever seeing the pages from the pipe =
- but
> the crash still happens even with this change.

With the DIO output isolation in iov_iter_extract_pipe_pages(), this chang=
e
can be removed without causing oopses to happen.

David