Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 5 May 2013 15:03:13 -0400
From: Rich Felker <>
Subject: Re: procfs stdio writev problem

On Sun, May 05, 2013 at 08:49:50PM +0200, Jens wrote:
> >--- ./src/stdio/__stdio_write.c~ 2012-12-01 22:56:34.156555480 +0000
> >+++ ./src/stdio/__stdio_write.c 2013-05-05 10:59:49.856504883 +0100
> >@@ -37,7 +37,7 @@
> > return iovcnt == 2 ? 0 : len-iov[0].iov_len;
> > }
> > rem -= cnt;
> >- if (cnt > iov[0].iov_len) {
> >+ if (cnt >= iov[0].iov_len) {
> > f->wpos = f->wbase = f->buf;
> > cnt -= iov[0].iov_len;
> > iov++; iovcnt--;
> >
> >In the case where the kernel exactly eats the iov you need to move
> >onto the next one rather than have a zero length write pointing just
> >after the existing one, as that could be an invalid address.
> In this case its not the zero length that is the problem.
> The problem is that procfs treats each write (or apprently each part
> of the iov) as a separate operation.
> So the first operation is "60" which is fine.
> The next one is "\n" which is invalid.
> So we get two operations instead of one.
> The implementation in bash amounts to a printf("60") followed by
> putchar('\n');
> The same thing in uclibc works as intended.
> I guess I can patch bash, or use sysctl program.
> AFAIK neither musl or procfs is doing anything wrong here, it just
> happens that a pure echo no longer works as it used to.

I would say this is clearly a bug in procfs, for multiple reasons:

1. As far as I can tell, there's no documentation that the value has
   to be written via a single syscall. Unless otherwise documented,
   one would except repeated calls to putc() on an unbuffered stream
   to work. As it stands, they don't (with any libc).

2. POSIX requires that readv and writev behave the same as the
   corresponding single read and write calls. There's at least one
   other Linux bug in this area that we're already working around,
   with regards to how readv works on terminals.

Unfortunately I don't see any clean workaround for the issue. Linux
purposefully made it impossible to determine if a file is a proc
pseudo-file via falsely reporting files in /proc as regular files (via
stat) so there's no way to even detect that a workaround would be


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.