linux-kernel - Re: 4.9.0 regression in pipe-backed iov

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 12 Jan 2017 23:27:19 +0000
From:   Al Viro <viro@...IV.linux.org.uk>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     "Alan J. Wylie" <alan@...ie.me.uk>,
        Thorsten Leemhuis <regressions@...mhuis.info>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: 4.9.0 regression in pipe-backed iov_iter with systemd-nspawn

On Thu, Jan 12, 2017 at 03:14:41PM -0800, Linus Torvalds wrote:
> On Thu, Jan 12, 2017 at 3:02 PM, Linus Torvalds
> <torvalds@...ux-foundation.org> wrote:
> >
> > Looking at the callers of "do_splice_to()", we already have the
> > wait_for_space() in do_splice(), but we do *not* have it in the
> > do_splice_from() case when both the input and output file descriptors
> > are pipes.
> 
> Bah. That case doesn't even trigger the new code. I was lazy with my
> grep. The two cases are "do_splice()" (which does have the
> wait-for-space) and splice_direct_to_actor(). And
> splice_direct_to_actor() shouldn't even need it, should it?
> 
> So ignore that. But I think there is something about the EAGAIN.

It might, but I would really like to see where has that EAGAIN come
from.  I see several possibilities:
	* wait_for_space() with SPLICE_F_NONBLOCK in flags.  Shouldn't
happen with 0 in the last argument of splice(2).
	* default_file_splice_read() seeing pipe->nrbufs == pipe->buffers.
Shouldn't be possible after successful wait_for_space().
	* vfs_readv() returning -EAGAIN.  That might be possible,
actually - the damn thing has come from
13761 open("/dev/ptmx", O_RDWR|O_NOCTTY|O_NONBLOCK|O_CLOEXEC) = 5
and O_NONBLOCK had been present in open flags.

What I'd like to see is strace of the same thing on the working kernel,
ideally - just prior to the commit bisect has converged to.