syzbot is reporting hung task at pipe_release() [1], for for_each_bvec() from
iterate_bvec() from iterate_all_kinds() from iov_iter_alignment() from
ext4_unaligned_io() from ext4_dio_write_iter() from ext4_file_write_iter() from
call_write_iter() from do_iter_readv_writev() from do_iter_write() from
vfs_iter_write() from iter_file_splice_write() falls into infinite busy loop
with pipe->mutex held.

The reason of falling into infinite busy loop is that iter_file_splice_write()
for some reason generates "struct bio_vec" entry with .bv_len=0 and .bv_offset=0
while for_each_bvec() cannot handle .bv_len == 0.

--- a/fs/splice.c
+++ b/fs/splice.c
@@ -747,6 +747,14 @@ iter_file_splice_write(struct pipe_inode_info *pipe, 
struct file *out,
                iov_iter_bvec(&from, WRITE, array, n, sd.total_len - left);
+               if (!strncmp(current->comm, "syz-executor", 12)) {
+                       int i;
+                       printk("Starting vfs_write_iter from.type=%d 
from.iov_offset=%zu from.count=%zu n=%u sd.total_len=%zu left=%zu\n",
+                              from.type, from.iov_offset, from.count, n, 
sd.total_len, left);
+                       for (i = 0; i < n; i++)
+                               printk("  array[%u]: bv_page=%px bv_len=%u 
+                                      i, array[i].bv_page, array[i].bv_len, 
+               }
                ret = vfs_iter_write(out, &from, &sd.pos, 0);
                if (ret <= 0)

When splice() from pipe to file works.

[   31.704915][ T6552] Starting vfs_write_iter from.type=17 from.iov_offset=0 
from.count=4096 n=1 sd.total_len=65504 left=61408
[   31.709098][ T6552]   array[0]: bv_page=ffffea000870a7c0 bv_len=4096 

When splice() from pipe to file falls into infinite busy loop.

[   31.717178][ T6553] Starting vfs_write_iter from.type=17 from.iov_offset=0 
from.count=4096 n=2 sd.total_len=65504 left=61408
[   31.720983][ T6553]   array[0]: bv_page=ffffea0008706680 bv_len=0 bv_offset=0
[   31.723565][ T6553]   array[1]: bv_page=ffffea00086f4e80 bv_len=4096 

Is it normal behavior that an empty page is linked to pipe's array?
If yes, don't we need to skip empty pages when iter_file_splice_write() fills 
in "struct bio_vec *array" ?


Reply via email to