$ wget https://mirrors.tuna.tsinghua.edu.cn/kernel/v5.x/linux-5.16.10.tar.xz
$ tar -xvf linux-5.16.10.tar.xz
# KASAN: 设置 make menuconfig 设置"Kernel hacking" ->"Memory Debugging" -> "KASan: runtime memory debugger"。
$ make -j32
$ make all
$ make modules
# 编译出的bzImage目录：/arch/x86/boot/bzImage。

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index b0e0acdf96c15..6dd5330f7a995 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -414,6 +414,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by
 		return 0;
 
 	buf->ops = &page_cache_pipe_buf_ops;
+	buf->flags = 0;
 	get_page(page);
 	buf->page = page;
 	buf->offset = offset;
@@ -577,6 +578,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size,
 			break;
 
 		buf->ops = &default_pipe_buf_ops;
+		buf->flags = 0;
 		buf->page = page;
 		buf->offset = 0;
 		buf->len = min_t(ssize_t, left, PAGE_SIZE);

const struct file_operations pipefifo_fops = {
	.open		= fifo_open,
	.llseek		= no_llseek,
	.read_iter	= pipe_read,
	.write_iter	= pipe_write,
	.poll		= pipe_poll,
	.unlocked_ioctl	= pipe_ioctl,
	.release	= pipe_release,
	.fasync		= pipe_fasync,
	.splice_write	= iter_file_splice_write,
};

static ssize_t pipe_write(struct kiocb *iocb, struct iov_iter *from)
{
	struct file *filp = iocb->ki_filp;
	struct pipe_inode_info *pipe = filp->private_data;
	unsigned int head;
	ssize_t ret = 0;
	size_t total_len = iov_iter_count(from);
	ssize_t chars;
	bool was_empty = false;
	bool wake_next_writer = false;
	...
	head = pipe->head;
	was_empty = pipe_empty(head, pipe->tail);
	chars = total_len & (PAGE_SIZE-1);  // 计算要写入的数据总大小是否是页帧大小的倍数，并将余数保存在 chars 变量中
	if (chars && !was_empty) {          // [1] 如果 chars 不为零，而且 pipe 不为空, 则尝试接着当前页往后写
		unsigned int mask = pipe->ring_size - 1;
		struct pipe_buffer *buf = &pipe->bufs[(head - 1) & mask]; // 获取 pipe 头部的缓冲区
		int offset = buf->offset + buf->len;

		if ((buf->flags & PIPE_BUF_FLAG_CAN_MERGE) &&   // [2] 如果缓冲区设置了标志位 PIPE_BUF_FLAG_CAN_MERGE, 且写入长度不会跨页, 则将 chars 长度的数据写入到当前的缓冲区中
		    offset + chars <= PAGE_SIZE) {
			ret = pipe_buf_confirm(pipe, buf);
			...
			ret = copy_page_from_iter(buf->page, offset, chars, from);
			...
			buf->len += ret;
			if (!iov_iter_count(from))  // 如果剩余要写入的数据大小为零，则直接返回
				goto out;
		}
	}

	for (;;) {					// [3] 如果没办法接着写，则另起一页
		if (!pipe->readers) {   // 判断 pipe 的读者数量是否为零
			send_sig(SIGPIPE, current, 0);
			if (!ret)
				ret = -EPIPE;
			break;
		}

		head = pipe->head;
		if (!pipe_full(head, pipe->tail, pipe->max_usage)) { // 如果 pipe 没有被填满
			unsigned int mask = pipe->ring_size - 1;
			struct pipe_buffer *buf = &pipe->bufs[head & mask]; // 获取 pipe 头部的缓冲区
			struct page *page = pipe->tmp_page;
			int copied;

			if (!page) {       // [4] 如果还没有为缓冲区分配页帧, 则申请新页
				page = alloc_page(GFP_HIGHUSER | __GFP_ACCOUNT);
				...
				pipe->tmp_page = page;
			}

			spin_lock_irq(&pipe->rd_wait.lock); // 使用自旋锁锁住 pipe 的读者等待队列。

			head = pipe->head;
			...
			pipe->head = head + 1; // 将 pipe_inode_info 结构的 head 字段值加 1
			spin_unlock_irq(&pipe->rd_wait.lock); // 释放自旋锁

			/* Insert it into the buffer array */
			buf = &pipe->bufs[head & mask]; // 设置当前缓冲区的字段
			buf->page = page;				// 新页放到页数组中
			buf->ops = &anon_pipe_buf_ops;
			buf->offset = 0;
			buf->len = 0;
			if (is_packetized(filp)) 
				buf->flags = PIPE_BUF_FLAG_PACKET;
			else
				buf->flags = PIPE_BUF_FLAG_CAN_MERGE; // [5] 如果创建 pipe 时未指定 O_DIRECT 选项, 则设置flag
			pipe->tmp_page = NULL;

			copied = copy_page_from_iter(page, 0, PAGE_SIZE, from); // [6] 将要写入的数据拷贝到当前的缓冲区
			...
			ret += copied;		// 设置相应的偏移量字段
			buf->offset = 0;
			buf->len = copied;

			if (!iov_iter_count(from))
				break;
		}

		if (!pipe_full(head, pipe->tail, pipe->max_usage))
			continue;
		...
	}
}

ssize_t splice(int fd_in, off64_t *off_in, int fd_out, off64_t *off_out, size_t len, unsigned int flags);
// fd_in: 一个普通文件
// off_in: 从指定的文件偏移处开始读取
// fd_out: 指代一个pipe
// len: 要传输的数据长度
// flags: 标志位

// page 是文件对应的内存页帧, struct iov_iter 对象包含 pipe_inode_info 对象
static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t bytes,
			 struct iov_iter *i)
{
	struct pipe_inode_info *pipe = i->pipe;
	struct pipe_buffer *buf;
	unsigned int p_tail = pipe->tail;
	unsigned int p_mask = pipe->ring_size - 1;
	unsigned int i_head = i->head;
	size_t off;
	...
	off = i->iov_offset;
	buf = &pipe->bufs[i_head & p_mask];  // [1] 获取 pipe->head 缓存页
	if (off) {
		if (offset == off && buf->page == page) {
			/* merge with the last one */
			buf->len += bytes;
			i->iov_offset += bytes;
			goto out;
		}
		i_head++;
		buf = &pipe->bufs[i_head & p_mask];
	}
	if (pipe_full(i_head, p_tail, pipe->max_usage))
		return 0;

	buf->ops = &page_cache_pipe_buf_ops; 
	get_page(page);   // 增加 page 实例的引用计数
	buf->page = page; // [2] 将 pipe 缓冲区的 page 指针指向文件的 page
	buf->offset = offset; // offset len 等设置为当前信息(通过splice 传入参数决定)
	buf->len = bytes;

	pipe->head = i_head + 1;
	i->iov_offset = offset + bytes;
	i->head = i_head;
out:
	i->count -= bytes;
	return bytes;
}

// poc1:write
	int fd = open("./tmpFile", O_WRONLY);
    while (1)
    {
        write(fd, "AAAAA", 5);
    }
// poc2:splice
	int fd = open("./tmpFile", O_WRONLY);
	int p[2];
	pipe(p);
	while (1)
    {
        splice(fd, 0, p[1], NULL, 5, 0);
        write(p[1], "BBBBB", 5);
    }