linux-kernel - sendfile() > 2GB to pipe fails with EFBIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 18 May 2017 19:56:26 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:     linux-fsdevel@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org
Subject: sendfile() > 2GB to pipe fails with EFBIG

Hello.

I tried to sendfile() a file which is larger than 4GB to a pipe (which is
the stdout of Apache's CGI program) using 3.10.0-514.16.1.el7.x86_64 kernel,
and noticed that sendfile() fails with EFBIG after 2GB is copied to stdout pipe.

I confirmed using 4.12.0-rc1 kernel that sendfile() still updates file position
of the file descriptor of the pipe. Since pipes are not lseek()able, I think that
sendfile() should not update file position if the file descriptor refers to
an non-lseek()able object.

----------
#define _GNU_SOURCE
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/sendfile.h>

int main(int argc, char *argv[])
{
        int pipe_fd[2];
        int fd = open("/etc/fstab", O_RDONLY);
        char buffer[128] = { };
        if (pipe(pipe_fd) || pipe_fd[1] != 5 ||
            write(pipe_fd[1], buffer, 1) != 1 ||
            splice(fd, NULL, pipe_fd[1], NULL, 2, 0) != 2 ||
            sendfile(pipe_fd[1], fd, NULL, 4) != 4 || close(fd))
                return 1;
        write(1, buffer, read(open("/proc/self/fdinfo/5", O_RDONLY), buffer, sizeof(buffer)));
        return 0;
}
----------

----------
pos:    4
flags:  01
mnt_id: 12
----------