lkml.org 
[lkml]   [2006]   [Nov]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: 2.6.19-rc4-mm1: writev() _functional_ regression
Andrew Morton wrote:
> On Sun, 12 Nov 2006 17:30:24 -0500
> Nick Orlov <bugfixer@list.ru> wrote:
>
>
>>Andrew,
>>
>>Somewhere in between 2.6.18-mm3 and 2.6.19-rc4-mm1 writev() got screwed.
>>It does not accept zero-length segments anymore.
>>
>>Bad thing that it is extremely easy to trigger (even w/o explicit writev calls).
>>For example the following innocent program will fail with 2.6.19-rc4-mm1:
>>
>>======================
>>#include <string.h>
>>#include <fstream>
>>
>>int main()
>>{
>> char buf[1024];
>> memset(buf, 'A', sizeof(buf));
>> std::ofstream ofs("test");
>> //ofs << 1 << '\n';
>> ofs.write(buf, sizeof(buf));
>> return 0;
>>}
>>======================
>>
>>
>>Here is the corresponding part if strace:
>>
>>======================
>>open("test", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 3
>>writev(3, [{NULL, 0}, {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 1024}], 2) = -1 EFAULT (Bad address)
>>close(3) = 0
>>======================
>>
>>
>>With 2.6.18-mm3 it works
>>
>>======================
>>open("test", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 3
>>writev(3, [{NULL, 0}, {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 1024}], 2) = 1024
>>close(3) = 0
>>======================
>>
>>
>>It works with 2.6.19-rc4-mm1 _if_ zero-length segments are eliminated
>>(by uncommenting ofs << 1 << '\n'):
>>
>>======================
>>open("test", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 3
>>writev(3, [{"1\n", 2}, {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 1024}], 2) = 1026
>>close(3) = 0
>>======================
>>
>>
>>Given that _all_ applications using C++ streams are potentially affected
>>I think it's better to preserve the previous behavior even if it is
>>something from "undefined behavior world" (or a plain bug).
>>
>>The bug is quite dangerous (I was really close to wipe out my mp3 collection).
>>
>
>
> OK, thanks. Those patches do need more work. I'll shelve them for a while.

Yeah, this just needs some kind of 0 size check in the access check
(arguably fault_in_pages_readable could check for zero size, but it could
go into the caller just as easily).

Thanks for reporting.

--
SUSE Labs, Novell Inc.
Send instant messages to your online friends http://au.messenger.yahoo.com

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-11-27 07:21    [W:0.055 / U:0.216 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site