Re: Endless loop in udp with MSG_SPLICE_READ - Re: [syzbot] [fs?] INFO: task hung in pipe_release (4)

From: David Howells
Date: Tue Aug 01 2023 - 10:02:10 EST

Willem de Bruijn <willemdebruijn.kernel@xxxxxxxxx> wrote:

> That getfrag is needed. For non-splice cases, to fill the linear part
> of an skb. As your example shows, it is skipped if all data is covered
> by pagedlen?

Yes, because copy goes negative. To quote from the previously quoted log:

==>splice_to_socket() 6630
__ip_append_data(copy=-1,len=8, mtu=8192 skblen=8189 maxfl=8188)
pagedlen 9 = 9 - 0
copy -1 = 9 - 0 - 1 - 9

copy is -(the number of excess bytes).

length 8 -= -1 + 0

which then gets deducted from the length - but why? I wonder if copy should
be cleared if we don't call getfrag(). It looks like it's meant to deduct the
amount copied by getfrag(), but that doesn't happen if copy < 0.

Also, note that MSG_ZEROCOPY might see the same maths issue here.