Re: [syzbot] general protection fault in skb_dequeue (3)

[David Howells]

David Howells <dhowells@xxxxxxxxxx> wrote:

> I think I have managed to isolate the bug to the read side of sendfile() or
> the pipe in the middle by the following:
> 
> In iter_file_splice_write(), I allocate a permanent page:
> ...
> and then stick it into the BVEC iter to be handed over to vfs_iter_write()
> instead of buf->page:
> 
> -			array[n].bv_page = buf->page;
> +			array[n].bv_page = splice_tmp;
> +			trace_page_ref_set(splice_tmp, 887);
>  			array[n].bv_len = this_len;
>  			array[n].bv_offset = buf->offset;
> 
> that prevents vfs_iter_write() from ever seeing the pages from the pipe - but
> the crash still happens even with this change.

With the DIO output isolation in iov_iter_extract_pipe_pages(), this change
can be removed without causing oopses to happen.

David