Re: 4.9.0 regression in pipe-backed iov_iter with systemd-nspawn

From: Al Viro
Date: Fri Jan 13 2017 - 05:20:32 EST


On Fri, Jan 13, 2017 at 09:54:02AM +0000, Alan J. Wylie wrote:
> root 1669 0.0 0.0 76144 5412 ? S 09:51 0:00 \_ /usr/sbin/postdrop -r
>
> Another hang.
>
> # dmesg | tail
> [ 22.352442] r8169 0000:03:00.0: loading /lib/firmware/4.9.3-dirty/rtl_nic/rtl8168e-3.fw failed with error -2
> [ 22.408814] r8169 0000:03:00.0: direct-loading rtl_nic/rtl8168e-3.fw
> [ 22.408821] fw_set_page_data: fw-rtl_nic/rtl8168e-3.fw buf=ffff92b7b1cb8c80 data=ffffad1641179000 size=3872
> [ 22.536043] r8169 0000:03:00.0 enp3s0: link down
> [ 22.536079] r8169 0000:03:00.0 enp3s0: link down
> [ 24.873801] r8169 0000:03:00.0 enp3s0: link up
> [ 24.874766] br0: port 1(enp3s0) entered blocking state
> [ 24.876622] br0: port 1(enp3s0) entered forwarding state
> [ 24.878560] IPv6: ADDRCONF(NETDEV_CHANGE): br0: link becomes ready
> [ 219.683974] nr: 0->16, cur: 5->5, buffers: 16->16

OK, so it is iov_iter_advance() failing to free the shit allocated, either
due to some breakage in pipe_advance() or buggered 'copied'... Let's
see which one; could you apply the following and run your reproducer? The
only difference from the previous is that it collects and prints a bit more,
so it should be just as reproducible...

diff --git a/fs/splice.c b/fs/splice.c
index 873d83104e79..11477609e7f7 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -393,6 +393,10 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
size_t offset, dummy, copied = 0;
ssize_t res;
int i;
+ unsigned nrbufs = pipe->nrbufs,
+ curbuf = pipe->curbuf,
+ buffers = pipe->buffers;
+ int idx, count, offs;

if (pipe->nrbufs == pipe->buffers)
return -EAGAIN;
@@ -444,7 +448,22 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
for (i = 0; i < nr_pages; i++)
put_page(pages[i]);
kvfree(pages);
+ count = to.count;
+ idx = to.idx;
+ offs = to.iov_offset;
iov_iter_advance(&to, copied); /* truncates and discards */
+ if (res == -EAGAIN && (
+ pipe->nrbufs != nrbufs ||
+ pipe->curbuf != curbuf ||
+ pipe->buffers != buffers)
+ ) {
+ printk(KERN_ERR "nr: %d->%d, cur: %d->%d, buffers: %d->%d\n",
+ nrbufs, pipe->nrbufs,
+ curbuf, pipe->curbuf,
+ buffers, pipe->buffers);
+ printk(KERN_ERR "copied: %zd, count:%d, idx:%d, offs:%d\n",
+ copied, count, idx, offs);
+ }
return res;
}