Skip to content

Resolve writable shadow_fd destination in sendfile#65

Open
ChuWeiChang wants to merge 1 commit intosysprog21:mainfrom
ChuWeiChang:Fix-incorrect-shadow-fd-destination-in-forward_sendfile
Open

Resolve writable shadow_fd destination in sendfile#65
ChuWeiChang wants to merge 1 commit intosysprog21:mainfrom
ChuWeiChang:Fix-incorrect-shadow-fd-destination-in-forward_sendfile

Conversation

@ChuWeiChang
Copy link
Copy Markdown
Contributor

@ChuWeiChang ChuWeiChang commented Apr 24, 2026

Fixes #64 and also help with test gap 5 in #38

Overview

There is a routing bug in forward_sendfile in seccomp_dispatch.c where destination shadow FDs were bypassing the virtual kernel (shadow_sp) and writing directly to the underlying physical host_fd.

What this PR does

  1. Adds an explicit fd_table_entry lookup for the destination out_fd prior to the emulation loop.
  2. Adds an integration test in test/guest/sendfile-test.c

Summary by cubic

Fixes sendfile routing when out_fd is a writeback shadow. Writes now go to shadow_sp (not the host or LKL fd) so close-time sync sees the data.

  • Bug Fixes
    • In forward_sendfile, look up out_fd in the fd table and, when shadow_writeback and shadow_sp are set, route writes to shadow_sp with fallback to LKL/host paths otherwise.
    • Add sendfile-test to verify data is written through the shadow path and enable it in run-tests.sh.

Written for commit 00002a8. Summary will update on new commits.

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 3 files

Comment thread tests/guest/sendfile-test.c Outdated
Comment on lines +2 to +4
/* Guest test: verify sendfile with a shadow-memfd input FD.
* sendfile must resolve the host fd through that shadow path via
* find_by_host_fd(); this test confirms data integrity end-to-end.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this test case reflect the problem you are addressing? If so, prove it.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, the test reflects the problem, though the original comments did not reflect the output FD as the relevant one. I've updated them.

When intercepting sendfile with out_fd as shadow_fd, forward_sendfile
mistakenly treat it as host_fd instead of shadow_sp.

Fix this by explicitly querying the out_fd's FD table entry. If
shadow_writeback is enabled, extract and write to shadow_sp instead.

Change-Id: Ifbe431c557f8d10cb2f4ab221176da336e35e067
@ChuWeiChang ChuWeiChang force-pushed the Fix-incorrect-shadow-fd-destination-in-forward_sendfile branch from 00006c0 to 00002a8 Compare May 10, 2026 08:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

forward_sendfile bypasses shadow_sp for writable shadow destination FDs

2 participants