linux-kernel - [RFC PATCH 0/3] pipe: Convert pipe->{head,tail} to unsigned short

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250306113924.20004-1-kprateek.nayak@amd.com>
Date: Thu, 6 Mar 2025 11:39:21 +0000
From: K Prateek Nayak <kprateek.nayak@....com>
To: Linus Torvalds <torvalds@...ux-foundation.org>, Oleg Nesterov
	<oleg@...hat.com>, Miklos Szeredi <miklos@...redi.hu>, Alexander Viro
	<viro@...iv.linux.org.uk>, Christian Brauner <brauner@...nel.org>, "Andrew
 Morton" <akpm@...ux-foundation.org>, Hugh Dickins <hughd@...gle.com>,
	<linux-fsdevel@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<linux-mm@...ck.org>
CC: Jan Kara <jack@...e.cz>, "Matthew Wilcox (Oracle)" <willy@...radead.org>,
	Mateusz Guzik <mjguzik@...il.com>, "Gautham R. Shenoy"
	<gautham.shenoy@....com>, Rasmus Villemoes <ravi@...vas.dk>,
	<Neeraj.Upadhyay@....com>, <Ananth.narayan@....com>, Swapnil Sapkal
	<swapnil.sapkal@....com>, K Prateek Nayak <kprateek.nayak@....com>
Subject: [RFC PATCH 0/3] pipe: Convert pipe->{head,tail} to unsigned short

Here is an attempt at converting pipe->{head,tail} to unsigned short
members. All local variables storing the head and the tail have been
modified to unsigned short too the best of my knowledge)

pipe_resize_ring() has added a check to make sure nr_slots can be
contained within the limits of the pipe->{head,tail}. Building on that,
pipe->{max_usage,ring_size} were also converted to unsigned short to
catch any cases of incorrect unsigned arithmetic.

This has been tested for a few hours with anon pipes on a 5th Generation
AMD EPYC System and on a dual socket Intel Granite Rapids system without
experiencing any obvious issues.

pipe_write() was tagged with a debug trace_printk() on one of the test
machines to make sure the head has indeed wrapped around behind the tail
to ensure the wraparound scenarios are indeed happening.

Few pipe_occupancy() and pipe->max_usage based checks have been
converted to use unsigned short based arithmetic in fs/fuse/dev.c,
fs/splice.c, mm/filemap.c, and mm/filemap.c. Few of the observations
from Rasmus on a parallel thread [1] has been folded into Patch 3
(thanks a ton for chasing them).

More eyes and testing is greatly appreciated. If my tests run into any
issues, I'll report back on this thread. Series was tested with:

  hackbench -g 16 -f 20 --threads --pipe -l 10000000 -s 100 # Warp around
  stress-ng --oom-pipe 128 --oom-pipe-ops 100000 -t 600s # pipe resize
  stress-ng --splice 128 --splice-ops 100000000 -t 600s # splice
  stress-ng --vm-splice 128 --vm-splice-ops 100000000 -t 600s # splice

  stress-ng --tee 128 --tee-ops 100000000 -t 600s
  stress-ng --zlib 128 --zlib-ops 1000000 -t 600s
  stress-ng --sigpipe 128 -t 60s

stress-ng did not report any failure in my testing.

[1] https://lore.kernel.org/all/87cyeu5zgk.fsf@prevas.dk/
--
K Prateek Nayak (3):
  fs/pipe: Limit the slots in pipe_resize_ring()
  fs/splice: Atomically read pipe->{head,tail} in opipe_prep()
  treewide: pipe: Convert all references to
    pipe->{head,tail,max_usage,ring_size} to unsigned short

 fs/fuse/dev.c             |  4 +++-
 fs/pipe.c                 | 33 +++++++++++++++-----------
 fs/splice.c               | 50 ++++++++++++++++++++-------------------
 include/linux/pipe_fs_i.h | 39 ++++++++++--------------------
 kernel/watch_queue.c      |  3 ++-
 mm/filemap.c              |  5 ++--
 mm/shmem.c                |  5 ++--
 7 files changed, 69 insertions(+), 70 deletions(-)

base-commit: 848e076317446f9c663771ddec142d7c2eb4cb43
-- 
2.43.0