linux-kernel - Re: 4.9.0 regression in pipe-backed iov

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170112231402.GD1555@ZenIV.linux.org.uk>
Date:   Thu, 12 Jan 2017 23:14:02 +0000
From:   Al Viro <viro@...IV.linux.org.uk>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     "Alan J. Wylie" <alan@...ie.me.uk>,
        Thorsten Leemhuis <regressions@...mhuis.info>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: 4.9.0 regression in pipe-backed iov_iter with systemd-nspawn

On Thu, Jan 12, 2017 at 03:02:13PM -0800, Linus Torvalds wrote:

>     splice(5, NULL, 1, NULL, 9223372036854775807, 0) = -1 EAGAIN
> (Resource temporarily unavailable)
> 
> and note that the commit in question introduces that -EAGAIN error code.
> 
> The old code never returned EAGAIN at all (well, it could do so later,
> if NONBLOCK was set, obviously, but that doesn't seem to be the case
> here).
> 
> So that commit seems to have introduced a new error case, and I
> suspect systemd-nospawn simply doesn't handle it. It is expecting
> splice_to_pipe() to actually block.
> 
> Ergo: I think we need to do a wait_for_space() somewhere, getting rid
> of the EAGAIN.
> 
> Looking at the callers of "do_splice_to()", we already have the
> wait_for_space() in do_splice(), but we do *not* have it in the
> do_splice_from() case when both the input and output file descriptors
> are pipes.

>From the look of his strace, the source is /dev/ptmx.  Pipe-to-pipe
splice goes into splice_pipe_to_pipe() anyway.  do_splice_from() is
pipe-to-non-pipe, and it doesn't go anywhere near default_file_splice_read()...

do_splice_to() is the only thing that can call default_file_splice_read()
and there are only two callers - do_splice() (with its wait_for_space())
and splice_direct_to_actor(), which has internal pipe for destination.
That certainly shouldn't be calling wait_for_space() - there's no other
thread that could possibly read from the destination getting more space
in there.

IOW, it's do_splice() -> do_splice_to() -> default_file_splice_read().