From nobody Wed Sep 30 09:51:22 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hvr0V4vCzz6v8Rh for ; Wed, 30 Sep 2026 09:51:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hvr0V4GqZz3Ml2 for ; Wed, 30 Sep 2026 09:51:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790761882; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YXcAbsgbTBvMH58HvNV1YOW7yzoTasvxhXbHZTZfTfE=; b=W+wk6v4cVTrCRqpUFk+a2WEmOyJ3P6C0HaX3Yshz4HrSts7nZ1DKRdvxXEQhts8ptE5MgY tI+ZreUodpc1WRkj2bdhUYzKF4/4viWUGwfCo2JXp0WNoXzW+6bujzT3lBVNMVv4TKxxPo e+lGPWV9P8KQ38zxoYr6/+vpBD/mQbeqV+Pced/LwWlQ6ATITgqZPh4b4aljklrWNtXw1r zQWRblmT3mQFwd4innjvEno11jXNTIuZLCSwZnj3nTf+/slM9eOeJDtR/Olagbsk5KEomY tB44vL0a21z50dOLggXF8ExJnygWXS8cnHmjFUELr7aVDLxLi5ab9IeX3j1grA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790761882; b=DpUmBwqUT4NWdmy/ehoF1x1sHC+U1h+/CBIdH4/ElST847+M1HdaPt5Y15pFJAW/kbnDSF d6Y6H/JCVIjDqkeE+gbWHFFR3qff47FxHoeV9CmugFwYViVxEKSeCCxZ3tngKTbM81k1m/ JpytJBY4K9VMl3wTxEmBYLAVuJFow1NOSmDbXOTPpdNaZPyE+zSu1T35uOpYWgiN33vqOq I+FHZm+yNnpKM79aK2n8wboyRBQafc8lbCx4XfNcEFuJP1IDvhm6DS2PaTM1LFHHoevqjo wgQdmhLt71aCGTDOFpi56AmQ7rcVjzrKd/tctAKbv5IyWxZ2dTPoQB25Yb41ug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790761882; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YXcAbsgbTBvMH58HvNV1YOW7yzoTasvxhXbHZTZfTfE=; b=T1HuQbIgSLm/oPTYf1XkzijMBkFvqaWn/vBEvBP/nuo/54d6maaXxy2OOloW4bdzW0brJT C3uFyJa8N7d9Vw8rxnqTmxS2B84kLNm3wYEaH2EcSnW1SM9mPGPH7lYo7BPnC5Dux1/+Xy XfxDo8o8+0MZjEf3LdPlUhWrA8VG5pHC9KTWxP8+r2XzNYyxvDoFRuF4kLE+coGGztFsMz VMCZAsX7v5ZdqsOgdkwJGL2+J75Pm3BRrPyHe5LL8ejtsZnPpPrSR0B0kgXQPAcX6Bi7hc 38BYpG6yQ9FGbzsMP4EaSZ9JAOv87j/Kzabvey4jyhVq0s6rea9WBhb/VExu3w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hvr0V3LwWzh1W for ; Wed, 30 Sep 2026 09:51:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 34344 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 30 Sep 2026 09:51:22 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Christos Margiolis Subject: git: 872c36cb6f2d - main - cuse: Fix hang on readv(2) and writev(2) with multiple iovecs List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 872c36cb6f2de17278c559a300c2163d8b39b3c6 Auto-Submitted: auto-generated Date: Wed, 30 Sep 2026 09:51:22 +0000 Message-Id: <6abcdb9a.34344.5db12e1c@gitrepo.freebsd.org> The branch main has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=872c36cb6f2de17278c559a300c2163d8b39b3c6 commit 872c36cb6f2de17278c559a300c2163d8b39b3c6 Author: Christos Margiolis AuthorDate: 2026-09-30 09:49:35 +0000 Commit: Christos Margiolis CommitDate: 2026-09-30 09:49:35 +0000 cuse: Fix hang on readv(2) and writev(2) with multiple iovecs uiomove() leaves an iovec it has just emptied as the current one, so cuse_client_read() and cuse_client_write() picked it up again on the next iteration, sent the server a zero-length command, and got zero bytes back. That left the residual count unchanged, so the loop never terminated and the call never returned. Step past empty iovecs at the start of every iteration. This also covers caller-supplied zero-length iovecs, which hung in the same way PR: 293489 MFC after: 1 week Sponsored by: The FreeBSD Foundation Reviewed by: kib, markj Differential Revision: https://reviews.freebsd.org/D59822 --- sys/fs/cuse/cuse.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/sys/fs/cuse/cuse.c b/sys/fs/cuse/cuse.c index ef786d125c15..c6107b977dac 100644 --- a/sys/fs/cuse/cuse.c +++ b/sys/fs/cuse/cuse.c @@ -1666,11 +1666,21 @@ cuse_client_read(struct cdev *dev, struct uio *uio, int ioflag) cuse_cmd_lock(pccmd); while (uio->uio_resid != 0) { - if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { + len = uio->uio_iov->iov_len; + /* + * The uiomove() below does not step past an iovec it has + * just emptied, so do it here, to avoid an infinite loop + * where we are requesting zero-byte transfers. + */ + if (len == 0) { + uio->uio_iov++; + uio->uio_iovcnt--; + continue; + } + if (len > CUSE_LENGTH_MAX) { error = ENOMEM; break; } - len = uio->uio_iov->iov_len; cuse_server_lock(pcs); if (len <= CUSE_COPY_BUFFER_MAX) { @@ -1754,11 +1764,21 @@ cuse_client_write(struct cdev *dev, struct uio *uio, int ioflag) cuse_cmd_lock(pccmd); while (uio->uio_resid != 0) { - if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { + len = uio->uio_iov->iov_len; + /* + * The uiomove() below does not step past an iovec it has + * just emptied, so do it here, to avoid an infinite loop + * where we are requesting zero-byte transfers. + */ + if (len == 0) { + uio->uio_iov++; + uio->uio_iovcnt--; + continue; + } + if (len > CUSE_LENGTH_MAX) { error = ENOMEM; break; } - len = uio->uio_iov->iov_len; if (len <= CUSE_COPY_BUFFER_MAX) { error = copyin(uio->uio_iov->iov_base,