Messages in this thread | | | From | Neil Brown <> | Date | Thu, 20 Apr 2006 08:18:52 +1000 | Subject | Re: [RFC] copy_from_user races with readpage |
| |
On Wednesday April 19, akpm@osdl.org wrote: > > The application is being a bit silly, because the read will return > indeterminate results depending on whether it gets there before or after > the write. But that's assuming that the read is reading the part of the > page which the writer is writing. If the reader is reading bytes 1000-1010 > and the writer is writing bytes 990-1000 then the reader is being non-silly > and would be justifiably surprised to see zeroes.
However this non-silly case will not cause a problem. If the write is writing bytes 990-1000, then only those bytes risk being zeroed by __copy_from_user. Bytes 1000-1010 (assuming those ranges are intended not to overlap) will not be at risk.
> > > I'd have thought that a sufficient fix would be to change > __copy_from_user_inatomic() to not do the zeroing, then review all users to > make sure that they cannot leak uninitialised memory.
I would agree with this.
NeilBrown - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |