将X字节写入文件描述符的正确方法，其中X是无符号的64位整数

Question

Consider the following C function:

static void                                                      
write_buf_to_disk(int fd, void *buf, __u64 size) {               
    const char* char_buf = buf;
    __u64 written = 0;                                           
    while (size > 0) {
        ssize_t res = write(fd, char_buf, size);
        if (res == -1) {                                         
            if (errno == EINTR) {                                
                // Write interrupted before anything written.    
                continue;                                        
            }                                                    
            err(EXIT_FAILURE, "write");                          
        }                                                        
        written += res;
        char_buf += res;
        size -= res;
    }                                                                              
}

The function reads bytes out of buf until the requested number of bytes have been written. The type of size is out of my control, and must be a __u64 .

I don't think this is portable due to friction between ssize_t and __u64 .

ssize_t comes from a rather vague POSIX extension which AFAICS guarantees to be:

• at least 16-bits wide
• signed
• the same size as a size_t

So in theory ssize_t could be (unlikely, I know) 512 bits wide, meaning that written += res invokes undefined behaviour.

How does one guard against this in a portable fashion?

Answer 1

res will be no higher than write 's third argument, so all you have to do is constrain the 3rd argument of write to be no larger than the largest positive value that res ( ssize_t ) can store.

In other words, replace

ssize_t res = write(fd, char_buf, size);

with

size_t block_size = SSIZE_MAX;
if (block_size > size)
   block_size = size;

ssize_t res = write(fd, char_buf, block_size);

You get:

static void
write_buf_to_disk(int fd, void *buf, __u64 size) {
    const char* char_buf = buf;
    size_t block_size = SSIZE_MAX;
    while (size > 0) {
        if (block_size > size)
            block_size = size;

        ssize_t res = write(fd, char_buf, block_size);
        if (res == -1) {
            if (errno == EINTR)
                continue;

            err(EXIT_FAILURE, "write");
        }

        char_buf += res;
        size     -= res;
    }
}

Answer 2

In

ssize_t res = write(fd, buf, size);

even if ssize_t would be 512 bits wide, as you suggested, the compiler promotes the result of write (64 bits) to that size. So the comparison would still work.

In

written += res;

the compiler would give you a warning, but 64 bits to count the number of bytes written is really gigantic (~10 ¹⁹ bytes max). So you're unlikely to miss any write even though the addition is from a 512 bits to a 64 bits.

You could also assign the size to a ssize_t at the beginning of the function

write_buf_to_disk(int fd, void *buf, __u64 size64) { 
   ssize_t size = size64;

that would make the rest of the body in line with the system functions.

Answer 3

The C11 standard says (7.19):

The types used for size_t and ptrdiff_t should not have an integer conversion rank greater than that of signed long int unless the implementation supports objects large enough to make this necessary.

So size_t and ssize_t are unlikely to be 512 bits, unless you run on a 512-bit processor.

Right now you are extremely likely not to need more than 64 bits for any memory or disk size. That limits the amount of data you can have in a write statement.