linux-kernel - Re: 4.9.0 regression in pipe-backed iov

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 13 Jan 2017 10:32:47 +0000
From:   "Alan J. Wylie" <alan@...ie.me.uk>
To:     Al Viro <viro@...IV.linux.org.uk>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Thorsten Leemhuis <regressions@...mhuis.info>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: 4.9.0 regression in pipe-backed iov_iter with systemd-nspawn

at 10:20 on Fri 13-Jan-2017 Al Viro (viro@...IV.linux.org.uk) wrote:

> OK, so it is iov_iter_advance() failing to free the shit allocated, either
> due to some breakage in pipe_advance() or buggered 'copied'...  Let's
> see which one; could you apply the following and run your reproducer?  The
> only difference from the previous is that it collects and prints a bit more,
> so it should be just as reproducible...

git reset --hard HEAD
vi ~/mail/INBOX patch2 
git apply patch2

# uname -a
Linux frodo 4.9.3-dirty #2 SMP PREEMPT Fri Jan 13 10:22:47 GMT 2017 x86_64 AMD FX(tm)-8350 Eight-Core Processor AuthenticAMD GNU/Linux

[hanging as expected]

# dmesg  | tail
...
[  141.553455] nr: 0->16, cur: 5->5, buffers: 16->16
[  141.553461] copied: 0, count:2147479552, idx:5, offs:0

> 
> diff --git a/fs/splice.c b/fs/splice.c
> index 873d83104e79..11477609e7f7 100644
> --- a/fs/splice.c
> +++ b/fs/splice.c
> @@ -393,6 +393,10 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
>  	size_t offset, dummy, copied = 0;
>  	ssize_t res;
>  	int i;
> +	unsigned nrbufs = pipe->nrbufs,
> +		 curbuf = pipe->curbuf,
> +		 buffers = pipe->buffers;
> +	int idx, count, offs;
>  
>  	if (pipe->nrbufs == pipe->buffers)
>  		return -EAGAIN;
> @@ -444,7 +448,22 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
>  	for (i = 0; i < nr_pages; i++)
>  		put_page(pages[i]);
>  	kvfree(pages);
> +	count = to.count;
> +	idx = to.idx;
> +	offs = to.iov_offset;
>  	iov_iter_advance(&to, copied);	/* truncates and discards */
> +	if (res == -EAGAIN && (
> +		pipe->nrbufs != nrbufs ||
> +		pipe->curbuf != curbuf ||
> +		pipe->buffers != buffers)
> +	    ) {
> +		printk(KERN_ERR "nr: %d->%d, cur: %d->%d, buffers: %d->%d\n",
> +			nrbufs, pipe->nrbufs,
> +			curbuf, pipe->curbuf,
> +			buffers, pipe->buffers);
> +		printk(KERN_ERR "copied: %zd, count:%d, idx:%d, offs:%d\n",
> +			copied, count, idx, offs);
> +	}
>  	return res;
>  }
>  

-- 
Alan J. Wylie                                          http://www.wylie.me.uk/

Dance like no-one's watching. / Encrypt like everyone is.
Security is inversely proportional to convenience