From: Jann Horn <jannh@google.com>
To: Al Viro <viro@zeniv.linux.org.uk>,
Miklos Szeredi <miklos@szeredi.hu>, Jens Axboe <axboe@kernel.dk>,
Jens Axboe <axboe@fb.com>
Cc: kernel list <linux-kernel@vger.kernel.org>,
linux-fsdevel@vger.kernel.org
Subject: Re: sys_tee() bug: after tee() of partial page, both pipes can merge, clobbering each other's data
Date: Mon, 15 Oct 2018 16:21:09 +0200 [thread overview]
Message-ID: <CAG48ez09LXvVv_u+uSBR+hYqmQAGO1iFf9gGvcOKGGMKXKvnvg@mail.gmail.com> (raw)
In-Reply-To: <CAG48ez1wN=oC_uWkHHhboDvfVt8p9O98ZMFZyh=AK6D=eHU7MA@mail.gmail.com>
On Mon, Oct 15, 2018 at 4:13 AM Jann Horn <jannh@google.com> wrote:
> I noticed the following behavior; basically, after copying part of a
> normal pipe buffer (anon_pipe_buf_ops) from pipe A to pipe B, both
> pipe A and pipe B can merge new writes into the existing page,
> clobbering each other's data:
>
> ============
> $ cat tee_test.c
> #define _GNU_SOURCE
> #include <fcntl.h>
> #include <unistd.h>
> #include <err.h>
> #include <stdio.h>
>
> int main(void) {
> int pipe_a[2];
> if (pipe(pipe_a)) err(1, "pipe");
> int pipe_b[2];
> if (pipe(pipe_b)) err(1, "pipe");
> if (write(pipe_a[1], "abcd", 4) != 4) err(1, "write");
> if (tee(pipe_a[0], pipe_b[1], 2, 0) != 2) err(1, "tee");
> if (write(pipe_b[1], "xx", 2) != 2) err(1, "write");
>
> char buf[5];
> if (read(pipe_a[0], buf, 4) != 4) err(1, "read");
> buf[4] = 0;
> printf("got back: '%s'\n", buf);
> }
> $ gcc -o tee_test tee_test.c
> $ ./tee_test
> got back: 'abxx'
> $
> ============
>
> splice_pipe_to_pipe() probably has the same problem?
>
> I'm not sure what the cleanest way to fix this would be. Replace
> anon_pipe_buf_ops with packet_pipe_buf_ops when copying a buffer? Or
> add a new buffer flag for marking a buffer as mergeable, and get rid
> of buf->ops->can_merge?
Actually, I'll just cook up a simple patch myself.
prev parent reply other threads:[~2018-10-15 14:21 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-15 2:13 sys_tee() bug: after tee() of partial page, both pipes can merge, clobbering each other's data Jann Horn
2018-10-15 14:21 ` Jann Horn [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAG48ez09LXvVv_u+uSBR+hYqmQAGO1iFf9gGvcOKGGMKXKvnvg@mail.gmail.com \
--to=jannh@google.com \
--cc=axboe@fb.com \
--cc=axboe@kernel.dk \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).