linux-kernel - Re: 4.9.0 regression in pipe-backed iov

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <22650.9362.298194.720245@wylie.me.uk>
Date:   Sat, 14 Jan 2017 13:16:02 +0000
From:   "Alan J. Wylie" <alan@...ie.me.uk>
To:     Al Viro <viro@...IV.linux.org.uk>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Thorsten Leemhuis <regressions@...mhuis.info>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: 4.9.0 regression in pipe-backed iov_iter with systemd-nspawn

at 22:50 on Fri 13-Jan-2017 Al Viro (viro@...IV.linux.org.uk) wrote:

> Or, even better, we can get rid of all wraparound-related crap if we
> calculate the final value of pipe->nrbufs and watch for _that_ as
> loop condition:
> 
> diff --git a/lib/iov_iter.c b/lib/iov_iter.c
> index 25f572303801..e68604ae3ced 100644
> --- a/lib/iov_iter.c
> +++ b/lib/iov_iter.c
> @@ -730,43 +730,50 @@ size_t iov_iter_copy_from_user_atomic(struct page *page,
>  }
>  EXPORT_SYMBOL(iov_iter_copy_from_user_atomic);
>  
> +static inline void pipe_truncate(struct iov_iter *i)
...

I've dragged an old box out of the storeroom and upgraded and
configured it so it reproduced the problem.

With the patch, the mail is sent with no hang

# uname -a
Linux maglor 4.9.3-dirty #3 SMP Sat Jan 14 12:13:45 GMT 2017 x86_64 AMD Athlon(tm) II X2 270 Processor AuthenticAMD GNU/Linux

Jan 14 12:56:01 maglor cron[741]: (root) CMD (date; /work/chroot-shared/test.sh; date)
Jan 14 12:56:01 maglor postfix/pickup[649]: 8577A604F2: uid=0 from=<root>
Jan 14 12:56:01 maglor postfix/cleanup[752]: 8577A604F2: message-id=<20170114125601.8577A604F2@...lor.localdomain>
Jan 14 12:56:01 maglor postfix/qmgr[650]: 8577A604F2: from=<root@...lor.localdomain>, size=735, nrcpt=1 (queue active)
Jan 14 12:56:01 maglor postfix/smtp[754]: 8577A604F2: to=<alan@...do.localnet>, orig_to=<root>, relay=frodo.localnet[192.168.21.2]:25, delay=0.54, delays=0.43/0/0.04/0.07, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as A08CC440065)
Jan 14 12:56:01 maglor postfix/qmgr[650]: 8577A604F2: removed

No other problems are apparent.

I'll run this for a bit, then apply it to my workstation (which I'm
rather fond of) and make sure there are no new regressions.

-- 
Alan J. Wylie                                          http://www.wylie.me.uk/

Dance like no-one's watching. / Encrypt like everyone is.
Security is inversely proportional to convenience