• David Howells's avatar
    afs: Fix AFS read bug · 29f06985
    David Howells authored
    Fix a bug in AFS read whereby the request page afs_read::index isn't
    incremented after calling ->page_done() if ->remain reaches 0, indicating
    that the data read is complete.
    
    Without this a NULL pointer exception happens when ->page_done() is called
    twice for the last page because the page clearing loop will call it also
    and afs_readpages_page_done() clears the current entry in the page list.
    
    BUG: unable to handle kernel NULL pointer dereference at           (null)
    IP: afs_readpages_page_done+0x21/0xa4 [kafs]
    PGD 0
    Oops: 0002 [#1] SMP
    Modules linked in: kafs(E)
    CPU: 2 PID: 3002 Comm: md5sum Tainted: G            E   4.10.0-fscache #485
    Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
    task: ffff8804017d86c0 task.stack: ffff8803fc1d8000
    RIP: 0010:afs_readpages_page_done+0x21/0xa4 [kafs]
    RSP: 0018:ffff8803fc1db978 EFLAGS: 00010282
    RAX: ffff880405d39af8 RBX: 0000000000000000 RCX: ffff880407d83ed4
    RDX: 0000000000000000 RSI: ffff880405d39a00 RDI: ffff880405c6f400
    RBP: ffff8803fc1db988 R08: 0000000000000000 R09: 0000000000000001
    R10: ffff8803fc1db820 R11: ffff88040cf56000 R12: ffff8804088f1780
    R13: ffff8804017d86c0 R14: ffff8804088f1780 R15: 0000000000003840
    FS:  00007f8154469700(0000) GS:ffff88041fb00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000000 CR3: 00000004016ec000 CR4: 00000000001406e0
    Call Trace:
     afs_deliver_fs_fetch_data+0x5b9/0x60e [kafs]
     ? afs_make_call+0x316/0x4e8 [kafs]
     ? afs_make_call+0x359/0x4e8 [kafs]
     afs_deliver_to_call+0x173/0x2e8 [kafs]
     ? afs_make_call+0x316/0x4e8 [kafs]
     afs_make_call+0x37a/0x4e8 [kafs]
     ? wake_up_q+0x4f/0x4f
     ? __init_waitqueue_head+0x36/0x49
     afs_fs_fetch_data+0x21c/0x227 [kafs]
     ? afs_fs_fetch_data+0x21c/0x227 [kafs]
     afs_vnode_fetch_data+0xf3/0x1d2 [kafs]
     afs_readpages+0x314/0x3fd [kafs]
     __do_page_cache_readahead+0x208/0x2c5
     ondemand_readahead+0x3a2/0x3b7
     ? ondemand_readahead+0x3a2/0x3b7
     page_cache_async_readahead+0x5e/0x67
     generic_file_read_iter+0x23b/0x70c
     ? __inode_security_revalidate+0x2f/0x62
     __vfs_read+0xc4/0xe8
     vfs_read+0xd1/0x15a
     SyS_read+0x4c/0x89
     do_syscall_64+0x80/0x191
     entry_SYSCALL64_slow_path+0x25/0x25
    Reported-by: default avatarMarc Dionne <marc.dionne@auristor.com>
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    Tested-by: default avatarMarc Dionne <marc.dionne@auristor.com>
    29f06985
fsclient.c 42.9 KB