Linux IO Multiplexing for Samba bug

1. I/O multiplexing
AIdrifter 2015/1/25

2. Problem
• Samba smbd will crash when timeout is
negative
• Analysis FreeBSD poll and select…

3. Descriptive
Name
File
Number
Description
StandardIn 0 Inputfromthe keyboard
StandardOut 1 Outputtothe console
StandardError 2
Error outputtothe
console
Process
File descriptor

4. Five IO models
blocking I/O: blocked all the way
non-blocking I/O: if no data in buffer, immediate
returns EWOULDBLOCK
I/O multiplexing (select and poll): blocked
separately in wait and copy
signal driven I/O (SIGIO): non-blocked in wait
but blocked in copy (signaled when I/O can be
initiated)
asynchronous I/O (aio_): non-blocked all the way
(signaled when I/O is complete)
Kernel’s
buffer
IO
Device
User
process
Wait for data
copy date
(system call)

5. Kernel’s
buffer
IO
Device
User
process
Select and poll

6. Select
1.Is the device readyfor reading? (writing
2.Kernel check the device buffer’s limits
->READY for reading(writing
3.Select return
IO Device
Kernel’s
buffer
User
process
INTPUT OUTPUT
4.Copy data by system
call(READ WRITE
no yes
4. next Select()

7. Select
• #include <sys/select.h>
• int select( int nfds,
fd_set *readset,
fd_set *writeset,
fd_set *exceptset,
struct timeval *timeout)
• struct timeval { /* Epoch 1970 1/1 00:00 */
long tv_sec; /* seconds*/
long tv_usec; /* microseconds*/
}
Timeout
 NULL blocking infinite time
 timout->tv-sec=10 wait ten seconds
 timout->tv-sec=10 =0 search once and return
nfds
Search range
0 0 0 0 0 0 0 0
fd0 fd1023
0
0 0 0 0 0 0 0 0
fd0 fd1023
0
0 0 0 0 0 0 0 0
fd0 fd1023
0
readset
writeset
execptset
FILE descriptors

8. 0 0 0 0 0 0 0 0
fd0 fd1023
FD_ZERO(fd_set *fdset)
initial
0
0 0 0 0 1 0 0 0
fd0 fd1023
FD_SET(int fd,fd_set *fdset)
loop
0
0 0 0 0 0 0 0 0
fd0 fd1023
FD_CLR(int fd,fd_set *fdset)
Don’t use the device
0
0 0 0 0 0 0 0 0
fd0 fd1023 FD_ISSET(int fd,fd_set *fdset)
Check ready?
->READ or WRITE
0
Check ready?

9. POLL
poll -- synchronousI/Omultiplexing
int poll (structpollfd fds[],
nfds_t nfds,
int timeout);
1.沒有最大文件描述符數量的限制。
2.Overhead is liners with number of file descriptions

10. POLL

11. Samba poll problem
• sys_poll don’t handle timeout < 0
• Solve issue
– 1.superviosr control
• But…..Supervisoralso have
negativetimeout problem
– 2.moodify timeout=1 , if timeout<0
• 2014-2016 negative
• 5- INT_MAX overflow
– 3.smd_parent_loopdefaultis 60s
• default sys_polltimeout range
– /*tv_usec < 10^6 */
– tv_usec and tv_sec is positve