linux-kernel - Re: Data corruption issue with splice() on 2.6.27.10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090107130829.GE6307@1wt.eu>
Date:	Wed, 7 Jan 2009 14:08:29 +0100
From:	Willy Tarreau <w@....eu>
To:	Evgeniy Polyakov <zbr@...emap.net>
Cc:	Herbert Xu <herbert@...dor.apana.org.au>,
	Jens Axboe <jens.axboe@...cle.com>,
	Jarek Poplawski <jarkao2@...il.com>,
	Changli Gao <xiaosuo@...il.com>, linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org
Subject: Re: Data corruption issue with splice() on 2.6.27.10

On Wed, Jan 07, 2009 at 03:57:56PM +0300, Evgeniy Polyakov wrote:
> On Wed, Jan 07, 2009 at 11:53:56PM +1100, Herbert Xu (herbert@...dor.apana.org.au) wrote:
> > On Wed, Jan 07, 2009 at 01:52:01PM +0100, Willy Tarreau wrote:
> > > 
> > > Evgeniy, I'd like to understand something related to our apparent lack of
> > > knowledge of when the data is effectively transmitted. If we're focusing
> > > on the send part, I can't understand why I never reproduce the corruption
> > > when the data source is a file or loopback, but I only see it when the source
> > > is an ethernet interface. How is it possible that a problem affecting only
> > 
> > It doesn't happen with a file because in that case you don't
> > start with an skb so there is no skb->head.  It probably doesn't
> > happen with loopback because loopback does GSO so again skb->head
> > does not exist (so to speak).
> 
> Yup, basically splice's transmit pipe buffer contains page references,
> where the first one is actually not a real page but skb, while in the
> case of sendfile() and/or splice() from the file first page is a real
> page of the appropriate file.

OK thanks guys for the clarifications.

Evgeniy, my printk() in tcp_sendpage() fired several times indicating we were
going through do_tcp_sendpage. During the same test, I observed a lot of
corruption.

Also, I have a good news. As you suggested, disabling both SG and GSO indeed
fixes the issue. do_tcp_sendpage() is not called anymore from tcp_sendpage()
in this case (according to dmesg).

Cheers,
Willy

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/