From nobody Wed Oct 07 06:24:32 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j034l07ZGz6vMX2 for ; Wed, 07 Oct 2026 06:24:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j034k1mTRz3NFL for ; Wed, 07 Oct 2026 06:24:38 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791354278; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zN82IVF+hLCdLGTIurIOthCmq32DIt3cRuzHdEP5IAg=; b=wSQXCc6COgKX3ZhIx4Dmf/3w5W1aaIyloje4reluzKPgf7QaMi4DXeCFPkN2hZh3OUEapR unRqUzE2mkIhHHmy+v6hoUjwFZZbxhWG8anNOufoWd4SQQLjIK2gF2BSOZH6XW8xvWkzW4 rARPSegvfQtYKw/wKRBP6+86XjVJgpkWA2yd2Co+hteXrWyYq3lLVziTA8o0ohUrZWZYp3 AJBsVV7nUdlvYc0pdvI5TuvnrYNTqy/Chsk2JuHEheVIbFwjYeqMD9Oi47i0N/Nu8hKNiI r/Hgz7gxGPF6AqgNFq6Lk4dEbGlv9GntsPrbTv2GM3fYI1PAHRQtI2ENdZ5Wpg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791354278; b=iFdndb4jUyq/wkGcFReqFLq5zocXi0unuVxDvEWTEIsqBqfxrA6iYcfRLsPKGLHqTs1qPE F0yAHr3LmPaycbHYME7N+QJoUq4VeWC17rEbzR6JCFbUUZqD80eR0wTM3gH6R1smbvSG5e WFKYLDmZXOJgOYGGG5r5s/M57rRUsd3FDfo0w0AFzKJzcCSdlqXBLyBGV2y5TzX63xlvjQ Lyc7lmf8TtxyWVPPcbcQ2x3WWjiAU+pa3NBptIpKwTxzBF23vTcCReU35GyreJ/nZD1n0G aTN7X+JCUb74UgwvcXPdx//eYpA5rqQPQZPgs0ftaOAcWFKbnvcdAQyeLg7Tag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791354278; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zN82IVF+hLCdLGTIurIOthCmq32DIt3cRuzHdEP5IAg=; b=j9mUfyqFxNtcVFRg3aKo+nvFcqIhCtR7QvqIxPdQp7OpA04ZYmMVw6NmWjuWVHa6owxnkE MnLtNAyoV4XReiy+9/OHjPnOa9/6e03Y0XdAq6OfF5eN8SpgB9QR+FMsGMJdIyeRAGU5Ao tfl0n6Sr1qrPZhTmF5E3b6a22+R29C5Fsr2wbEXiOrEkLpi7bkbXIiz38kgjrZ8ay2XTz0 +r1iFsIyeoINdUPg+8E1NTpvjsrn7a3qdPhJuPesUe+AU5qsQsydhoGQRyVEZ1VoRvzOar h6Y9Egt7yLCDcVkiBMGAbPk3UuU+fA6g/ZgdPeIEwK3ktUwAbmcV5qX5R6RucA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j034k0YBCzj8X for ; Wed, 07 Oct 2026 06:24:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 42361 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 07 Oct 2026 06:24:32 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Christos Margiolis Subject: git: b1aea70753bc - stable/15 - cuse: Fix hang on readv(2) and writev(2) with multiple iovecs List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: b1aea70753bca974af6b8e4814aecd1aaff29e2a Auto-Submitted: auto-generated Date: Wed, 07 Oct 2026 06:24:32 +0000 Message-Id: <6ac5e5a0.42361.2fe8d992@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=b1aea70753bca974af6b8e4814aecd1aaff29e2a commit b1aea70753bca974af6b8e4814aecd1aaff29e2a Author: Christos Margiolis AuthorDate: 2026-09-30 09:49:35 +0000 Commit: Christos Margiolis CommitDate: 2026-10-07 06:23:31 +0000 cuse: Fix hang on readv(2) and writev(2) with multiple iovecs uiomove() leaves an iovec it has just emptied as the current one, so cuse_client_read() and cuse_client_write() picked it up again on the next iteration, sent the server a zero-length command, and got zero bytes back. That left the residual count unchanged, so the loop never terminated and the call never returned. Step past empty iovecs at the start of every iteration. This also covers caller-supplied zero-length iovecs, which hung in the same way PR: 293489 MFC after: 1 week Sponsored by: The FreeBSD Foundation Reviewed by: kib, markj Differential Revision: https://reviews.freebsd.org/D59822 (cherry picked from commit 872c36cb6f2de17278c559a300c2163d8b39b3c6) --- sys/fs/cuse/cuse.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/sys/fs/cuse/cuse.c b/sys/fs/cuse/cuse.c index ef786d125c15..c6107b977dac 100644 --- a/sys/fs/cuse/cuse.c +++ b/sys/fs/cuse/cuse.c @@ -1666,11 +1666,21 @@ cuse_client_read(struct cdev *dev, struct uio *uio, int ioflag) cuse_cmd_lock(pccmd); while (uio->uio_resid != 0) { - if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { + len = uio->uio_iov->iov_len; + /* + * The uiomove() below does not step past an iovec it has + * just emptied, so do it here, to avoid an infinite loop + * where we are requesting zero-byte transfers. + */ + if (len == 0) { + uio->uio_iov++; + uio->uio_iovcnt--; + continue; + } + if (len > CUSE_LENGTH_MAX) { error = ENOMEM; break; } - len = uio->uio_iov->iov_len; cuse_server_lock(pcs); if (len <= CUSE_COPY_BUFFER_MAX) { @@ -1754,11 +1764,21 @@ cuse_client_write(struct cdev *dev, struct uio *uio, int ioflag) cuse_cmd_lock(pccmd); while (uio->uio_resid != 0) { - if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { + len = uio->uio_iov->iov_len; + /* + * The uiomove() below does not step past an iovec it has + * just emptied, so do it here, to avoid an infinite loop + * where we are requesting zero-byte transfers. + */ + if (len == 0) { + uio->uio_iov++; + uio->uio_iovcnt--; + continue; + } + if (len > CUSE_LENGTH_MAX) { error = ENOMEM; break; } - len = uio->uio_iov->iov_len; if (len <= CUSE_COPY_BUFFER_MAX) { error = copyin(uio->uio_iov->iov_base,