Messages in this thread Patch in this message | | | Date | Tue, 18 Sep 2012 16:31:24 -0400 | From | Konrad Rzeszutek Wilk <> | Subject | Re: 3.6rc6 slab corruption. |
| |
On Tue, Sep 18, 2012 at 01:24:15PM -0700, David Rientjes wrote: > On Tue, 18 Sep 2012, Konrad Rzeszutek Wilk wrote: > > > diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c > > index 2340f69..309b235 100644 > > --- a/fs/debugfs/file.c > > +++ b/fs/debugfs/file.c > > @@ -524,6 +524,7 @@ EXPORT_SYMBOL_GPL(debugfs_create_blob); > > struct array_data { > > void *array; > > u32 elements; > > + struct mutex lock; > > This should be a spinlock.
I would get warnings about using a spinlock.. .. snip.. > > + mutex_unlock(&data->lock); > > return simple_read_from_buffer(buf, len, ppos, > > file->private_data, size); > > } > > Your critical section isn't entirely covered since you're still accessing > file->private_data in the call to simple_read_from_buffer(). What happens > if a concurrent reader does file->private_data = NULL immediately after > your unlock?
Duh!
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c index 2340f69..c6d9088 100644 --- a/fs/debugfs/file.c +++ b/fs/debugfs/file.c @@ -524,6 +524,7 @@ EXPORT_SYMBOL_GPL(debugfs_create_blob); struct array_data { void *array; u32 elements; + struct mutex lock; }; static int u32_array_open(struct inode *inode, struct file *file) @@ -580,6 +581,7 @@ static ssize_t u32_array_read(struct file *file, char __user *buf, size_t len, struct array_data *data = inode->i_private; size_t size; + mutex_lock(&data->lock); if (*ppos == 0) { if (file->private_data) { kfree(file->private_data); @@ -594,8 +596,10 @@ static ssize_t u32_array_read(struct file *file, char __user *buf, size_t len, if (file->private_data) size = strlen(file->private_data); - return simple_read_from_buffer(buf, len, ppos, + size = simple_read_from_buffer(buf, len, ppos, file->private_data, size); + mutex_unlock(&data->lock); + return size; } static int u32_array_release(struct inode *inode, struct file *file) @@ -643,6 +647,7 @@ struct dentry *debugfs_create_u32_array(const char *name, umode_t mode, data->array = array; data->elements = elements; + mutex_init(&data->lock); return debugfs_create_file(name, mode, parent, data, &u32_array_fops); }
| |