lkml.org 
[lkml]   [2012]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[patch for-3.6] fs, debugfs: fix race in u32_array_read and allocate array at open
u32_array_open() is racy when multiple threads read from a file with a
seek position of zero, i.e. when two or more simultaneous reads are
occurring after the non-seekable files are created. It is possible that
file->private_data is double-freed because the threads races between

kfree(file->private-data);

and

file->private_data = NULL;

The fix is to only do format_array_alloc() when the file is opened and
free it when it is closed. This means that any thread that holds the
file open and reads multiple times will see persistent data; they must
close() and open() the file again to see new data, like a simple cat of
the file.

Reported-by: Dave Jones <davej@redhat.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Tested-by: Raghavendra <raghavendra.kt@linux.vnet.ibm.com>
Signed-off-by: David Rientjes <rientjes@google.com>
---
fs/debugfs/file.c | 33 +++++++++++----------------------
1 file changed, 11 insertions(+), 22 deletions(-)

diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -526,12 +526,6 @@ struct array_data {
u32 elements;
};

-static int u32_array_open(struct inode *inode, struct file *file)
-{
- file->private_data = NULL;
- return nonseekable_open(inode, file);
-}
-
static size_t format_array(char *buf, size_t bufsize, const char *fmt,
u32 *array, u32 array_size)
{
@@ -573,26 +567,21 @@ static char *format_array_alloc(const char *fmt, u32 *array,
return ret;
}

-static ssize_t u32_array_read(struct file *file, char __user *buf, size_t len,
- loff_t *ppos)
+static int u32_array_open(struct inode *inode, struct file *file)
{
- struct inode *inode = file->f_path.dentry->d_inode;
struct array_data *data = inode->i_private;
- size_t size;

- if (*ppos == 0) {
- if (file->private_data) {
- kfree(file->private_data);
- file->private_data = NULL;
- }
-
- file->private_data = format_array_alloc("%u", data->array,
- data->elements);
- }
+ file->private_data = format_array_alloc("%u", data->array,
+ data->elements);
+ if (!file->private_data)
+ return -ENOMEM;
+ return nonseekable_open(inode, file);
+}

- size = 0;
- if (file->private_data)
- size = strlen(file->private_data);
+static ssize_t u32_array_read(struct file *file, char __user *buf, size_t len,
+ loff_t *ppos)
+{
+ size_t size = strlen(file->private_data);

return simple_read_from_buffer(buf, len, ppos,
file->private_data, size);

\
 
 \ /
  Last update: 2012-09-21 12:21    [W:1.167 / U:0.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site