{"push_id":952275233,"size":1,"distinct_size":1,"ref":"refs/heads/n-3.0","head":"4a1b9e421723593e5bc5b24dcb31b958e5824eda","before":"a47dab1319f2340dfe34bb2d3bdad8bc846a4bfe","commits":[{"sha":"4a1b9e421723593e5bc5b24dcb31b958e5824eda","author":{"email":"3ca33452d0ba398506359975e18b2014a884f2c8@yandex-team.ru","name":"Roman Gushchin"},"message":"fuse: break infinite loop in fuse_fill_write_pages()\n\nI got a report about unkillable task eating CPU. Further\ninvestigation shows, that the problem is in the fuse_fill_write_pages()\nfunction. If iov's first segment has zero length, we get an infinite\nloop, because we never reach iov_iter_advance() call.\n\nFix this by calling iov_iter_advance() before repeating an attempt to\ncopy data from userspace.\n\nA similar problem is described in 124d3b7041f (\"fix writev regression:\npan hanging unkillable and un-straceable\"). If zero-length segmend\nis followed by segment with invalid address,\niov_iter_fault_in_readable() checks only first segment (zero-length),\niov_iter_copy_from_user_atomic() skips it, fails at second and\nreturns zero -> goto again without skipping zero-length segment.\n\nPatch calls iov_iter_advance() before goto again: we'll skip zero-length\nsegment at second iteraction and iov_iter_fault_in_readable() will detect\ninvalid address.\n\nSpecial thanks to Konstantin Khlebnikov, who helped a lot with the commit\ndescription.\n\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Maxim Patlasov <mpatlasov@parallels.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nSigned-off-by: Roman Gushchin <klamm@yandex-team.ru>\nSigned-off-by: Miklos Szeredi <miklos@szeredi.hu>\nFixes: ea9b9907b82a (\"fuse: implement perform_write\")\nCc: <stable@vger.kernel.org>\n\nConflicts:\n\tfs/fuse/file.c\n\nChange-Id: Id37193373294dd43191469389cfe68ca1736a54b","distinct":true,"url":"https://api.github.com/repos/NamelessRom/android_kernel_oneplus_msm8974/commits/4a1b9e421723593e5bc5b24dcb31b958e5824eda"}]}