Re: Bug#659499: bash fails to properly read /proc files

Re: Bug#659499: bash fails to properly read /proc files

[Ben Hutchings]

[-- Attachment #1.1: Type: text/plain, Size: 3466 bytes --]

On Sun, 2012-02-19 at 23:14 +0100, Cyril Brulebois wrote:
> Hi kernel folks,
> 
> here's a tiny analysis I tried to perform on bash's having issues with
> reading /proc files, which I think is related to seeking in those files.
> I can't play much with other kernel versions right now though. My tests
> were performed with squeeze's bpo kernel: 3.2.0-0.bpo.1-amd64 (Debian
> 3.2.4-1~bpo60+1).

The specific problem with seeking in /proc/net/dev appears to be caused
by this change:

commit f04565ddf52e401880f8ba51de0dff8ba51c99fd
Author: Mihai Maruseac <mihai.maruseac@gmail.com>
Date:   Thu Oct 20 20:45:10 2011 +0000

    dev: use name hash for dev_seq_ops

Ben.

[...]
> Attached is a reduced (as in “lighter than bash”) test case. The code is
> ugly but I'm throwing it over the wall before the BSP's end: built with
> bufsize=8000, everything is fine for my 600-ish bytes /proc/net/dev;
> built with bufsize=128, read()+lseek() seem to trigger nasty stuff as I
> suspected.
> 
> Here's the output for bufsize=8000:
> | $ gcc mini-test.c && ./a.out 
> | Warning: no file specified, defaulting to /proc/net/dev
> | Info: /proc/net/dev opened successfully
> | Read: 694
> | Found newline: 76 char-long line: with 617 extra chars:
> | Inter-|   Receive                                                |  Transmit
> | Read: 617
> | Found newline: 122 char-long line: with 494 extra chars:
> |  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
> | Read: 494
> | Found newline: 122 char-long line: with 371 extra chars:
> |     lo:   63886     451    0    0    0     0          0         0    63886     451    0    0    0     0       0          0
> | Read: 371
> | Found newline: 122 char-long line: with 248 extra chars:
> |   pan0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
> | Read: 248
> | Found newline: 124 char-long line: with 123 extra chars:
> |  wlan0: 151354717  197302    0    0    0     0          0         0 22011993  189809    0    0    0     0       0          0
> | Read: 123
> | Found newline: 122 char-long line: with 0 extra chars:
> |   eth0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
> | Final position: 694
> → OK
> 
> Here's the output for bufsize=128:
> | $ gcc mini-test.c && ./a.out 
> | Warning: no file specified, defaulting to /proc/net/dev
> | Info: /proc/net/dev opened successfully
> | Read: 128
> | Found newline: 76 char-long line: with 51 extra chars:
> | Inter-|   Receive                                                |  Transmit
> | Read: 128
> | Found newline: 122 char-long line: with 5 extra chars:
> |  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
> | Read: 128
> | Found newline: 122 char-long line: with 5 extra chars:
> |   pan0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
> | Final position: 323
> 
> Has anything like that been reported/fixed recently?
> 
> 
> (Probably my last one:) Thanks to IRILL for sponsoring this BSP in Paris.
> 
> Mraw,
> KiBi.

-- 
Ben Hutchings
Lowery's Law:
             If it jams, force it. If it breaks, it needed replacing anyway.

[-- Attachment #1.2: mini-test.c --]
[-- Type: text/x-csrc, Size: 1397 bytes --]

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <errno.h>
#include <string.h>

const char default_input[] = "/proc/net/dev";

int main(int argc, const char **argv) {
  const char *input = default_input;

  /* "usage" */
  if (argc < 2) {
    printf("Warning: no file specified, defaulting to %s\n", default_input);
  } else {
    input = argv[1];
    printf("Info: using %s as specified\n", argv[1]);
  }
  
  int file = open(input, 0);
  if (file < 0) {
    printf("Error: unable to open %s: %s\n", input, strerror(errno));
    return 1;
  } else {
    ssize_t ret;
    ssize_t current = 0;
    ssize_t extra = 0;

    printf("Info: %s opened successfully\n", input);

    /* this is ugly but oh well */
    #define bufsize (8000)

    char buf[bufsize+1] = "";
    while ((ret = read(file, buf, bufsize)) > 0) {
      printf("Read: %u\n", ret);
      char *newline = strchr(buf, '\n');
      if (newline) {
        current += (newline-buf);
        *newline = '\0';
        extra = ret-(newline-buf+1);
        printf("Found newline: %u char-long line: with %u extra chars:\n%s\n", current, extra, buf);
        lseek(file, -extra, SEEK_CUR);
        current = 0;
      }
    }
    printf("Final position: %u\n", lseek(file, 0, SEEK_CUR)); 
    close(file);
  }

  return 0;
}

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]

Re: Bug#659499: bash fails to properly read /proc files

[Ben Hutchings]

[-- Attachment #1.1: Type: text/plain, Size: 1262 bytes --]

On Sun, 2012-02-26 at 00:11 +0000, Ben Hutchings wrote:
> On Sun, 2012-02-19 at 23:14 +0100, Cyril Brulebois wrote:
> > Hi kernel folks,
> > 
> > here's a tiny analysis I tried to perform on bash's having issues with
> > reading /proc files, which I think is related to seeking in those files.
> > I can't play much with other kernel versions right now though. My tests
> > were performed with squeeze's bpo kernel: 3.2.0-0.bpo.1-amd64 (Debian
> > 3.2.4-1~bpo60+1).
> 
> The specific problem with seeking in /proc/net/dev appears to be caused
> by this change:
> 
> commit f04565ddf52e401880f8ba51de0dff8ba51c99fd
> Author: Mihai Maruseac <mihai.maruseac@gmail.com>
> Date:   Thu Oct 20 20:45:10 2011 +0000
> 
>     dev: use name hash for dev_seq_ops
[...]

This is supposed to be fixed by:

commit 2def16ae6b0c77571200f18ba4be049b03d75579
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Mon Apr 2 22:33:02 2012 +0000

    net: fix /proc/net/dev regression

which will be applied some time soon.  I'm attaching the patch in case
anyone would like to test it (see
<http://kernel-handbook.alioth.debian.org/ch-common-tasks.html#s-common-official>).

Ben.

-- 
Ben Hutchings
Larkinson's Law: All laws are basically false.

[-- Attachment #1.2: net-fix-proc-net-dev-regression.patch --]
[-- Type: text/x-patch, Size: 5983 bytes --]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Mon, 2 Apr 2012 22:33:02 +0000
Subject: [PATCH] net: fix /proc/net/dev regression

commit 2def16ae6b0c77571200f18ba4be049b03d75579 upstream.

Commit f04565ddf52 (dev: use name hash for dev_seq_ops) added a second
regression, as some devices are missing from /proc/net/dev if many
devices are defined.

When seq_file buffer is filled, the last ->next/show() method is
canceled (pos value is reverted to value prior ->next() call)

Problem is after above commit, we dont restart the lookup at right
position in ->start() method.

Fix this by removing the internal 'pos' pointer added in commit, since
we need to use the 'loff_t *pos' provided by seq_file layer.

This also reverts commit 5cac98dd0 (net: Fix corruption
in /proc/*/net/dev_mcast), since its not needed anymore.

Reported-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Mihai Maruseac <mmaruseac@ixiacom.com>
Tested-by:  Ben Greear <greearb@candelatech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
 include/linux/netdevice.h |    2 --
 net/core/dev.c            |   58 ++++++++++-----------------------------------
 net/core/dev_addr_lists.c |    3 ++-
 3 files changed, 15 insertions(+), 48 deletions(-)

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 1f77540..5cbaa20 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2604,8 +2604,6 @@ extern void		net_disable_timestamp(void);
 extern void *dev_seq_start(struct seq_file *seq, loff_t *pos);
 extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos);
 extern void dev_seq_stop(struct seq_file *seq, void *v);
-extern int dev_seq_open_ops(struct inode *inode, struct file *file,
-			    const struct seq_operations *ops);
 #endif
 
 extern int netdev_class_create_file(struct class_attribute *class_attr);
diff --git a/net/core/dev.c b/net/core/dev.c
index 6c7dc9d..c25d453 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4028,54 +4028,41 @@ static int dev_ifconf(struct net *net, char __user *arg)
 
 #ifdef CONFIG_PROC_FS
 
-#define BUCKET_SPACE (32 - NETDEV_HASHBITS)
-
-struct dev_iter_state {
-	struct seq_net_private p;
-	unsigned int pos; /* bucket << BUCKET_SPACE + offset */
-};
+#define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1)
 
 #define get_bucket(x) ((x) >> BUCKET_SPACE)
 #define get_offset(x) ((x) & ((1 << BUCKET_SPACE) - 1))
 #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
 
-static inline struct net_device *dev_from_same_bucket(struct seq_file *seq)
+static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff_t *pos)
 {
-	struct dev_iter_state *state = seq->private;
 	struct net *net = seq_file_net(seq);
 	struct net_device *dev;
 	struct hlist_node *p;
 	struct hlist_head *h;
-	unsigned int count, bucket, offset;
+	unsigned int count = 0, offset = get_offset(*pos);
 
-	bucket = get_bucket(state->pos);
-	offset = get_offset(state->pos);
-	h = &net->dev_name_head[bucket];
-	count = 0;
+	h = &net->dev_name_head[get_bucket(*pos)];
 	hlist_for_each_entry_rcu(dev, p, h, name_hlist) {
-		if (count++ == offset) {
-			state->pos = set_bucket_offset(bucket, count);
+		if (++count == offset)
 			return dev;
-		}
 	}
 
 	return NULL;
 }
 
-static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
+static inline struct net_device *dev_from_bucket(struct seq_file *seq, loff_t *pos)
 {
-	struct dev_iter_state *state = seq->private;
 	struct net_device *dev;
 	unsigned int bucket;
 
-	bucket = get_bucket(state->pos);
 	do {
-		dev = dev_from_same_bucket(seq);
+		dev = dev_from_same_bucket(seq, pos);
 		if (dev)
 			return dev;
 
-		bucket++;
-		state->pos = set_bucket_offset(bucket, 0);
+		bucket = get_bucket(*pos) + 1;
+		*pos = set_bucket_offset(bucket, 1);
 	} while (bucket < NETDEV_HASHENTRIES);
 
 	return NULL;
@@ -4088,33 +4075,20 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
 void *dev_seq_start(struct seq_file *seq, loff_t *pos)
 	__acquires(RCU)
 {
-	struct dev_iter_state *state = seq->private;
-
 	rcu_read_lock();
 	if (!*pos)
 		return SEQ_START_TOKEN;
 
-	/* check for end of the hash */
-	if (state->pos == 0 && *pos > 1)
+	if (get_bucket(*pos) >= NETDEV_HASHENTRIES)
 		return NULL;
 
-	return dev_from_new_bucket(seq);
+	return dev_from_bucket(seq, pos);
 }
 
 void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-	struct net_device *dev;
-
 	++*pos;
-
-	if (v == SEQ_START_TOKEN)
-		return dev_from_new_bucket(seq);
-
-	dev = dev_from_same_bucket(seq);
-	if (dev)
-		return dev;
-
-	return dev_from_new_bucket(seq);
+	return dev_from_bucket(seq, pos);
 }
 
 void dev_seq_stop(struct seq_file *seq, void *v)
@@ -4213,13 +4187,7 @@ static const struct seq_operations dev_seq_ops = {
 static int dev_seq_open(struct inode *inode, struct file *file)
 {
 	return seq_open_net(inode, file, &dev_seq_ops,
-			    sizeof(struct dev_iter_state));
-}
-
-int dev_seq_open_ops(struct inode *inode, struct file *file,
-		     const struct seq_operations *ops)
-{
-	return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state));
+			    sizeof(struct seq_net_private));
 }
 
 static const struct file_operations dev_seq_fops = {
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 29c07fe..626698f 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -696,7 +696,8 @@ static const struct seq_operations dev_mc_seq_ops = {
 
 static int dev_mc_seq_open(struct inode *inode, struct file *file)
 {
-	return dev_seq_open_ops(inode, file, &dev_mc_seq_ops);
+	return seq_open_net(inode, file, &dev_mc_seq_ops,
+			    sizeof(struct seq_net_private));
 }
 
 static const struct file_operations dev_mc_seq_fops = {
-- 
1.7.9.5


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]