linux-kernel - Re: [PATCH 1/2] sysfs: fix race between readdir and lseek

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 22 Mar 2013 13:48:46 +0800
From:	Li Zefan <lizefan@...wei.com>
To:	Ming Lei <ming.lei@...onical.com>
CC:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	<linux-kernel@...r.kernel.org>, <stable@...r.kernel.org>
Subject: Re: [PATCH 1/2] sysfs: fix race between readdir and lseek

On 2013/3/21 12:48, Ming Lei wrote:
> On Thu, Mar 21, 2013 at 11:28 AM, Li Zefan <lizefan@...wei.com> wrote:
>> On 2013/3/21 11:17, Ming Lei wrote:
>>> On Thu, Mar 21, 2013 at 10:41 AM, Li Zefan <lizefan@...wei.com> wrote:
>>>>
>>>> In fact the same race exists between readdir() and read()/write()...
>>>
>>> Fortunately, no read()/write() are implemented on sysfs directory, :-)
>>>
>>
>> That's irrelevant...
> 
> As far as sysfs is concerned, the filp->f_ops can't be changed in
> read/write path.
> 

Yes, it can...As I said, it's irrelevant, because it's vfs that changes
file->f_pos.

SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
{
        struct fd f = fdget(fd);
        ssize_t ret = -EBADF;

        if (f.file) {
                loff_t pos = file_pos_read(f.file);		<--- read f_pos
                ret = vfs_read(f.file, buf, count, &pos);	<--- return -EISDIR
                file_pos_write(f.file, pos);			<--- write f_pos
                fdput(f);
        }
        return ret;
}

>>
>> See my report:
>>
>> https://patchwork.kernel.org/patch/2160771/
> 
> Yes, I know there might be some mess after the commit ef3d0fd2
> (vfs: do (nearly) lockless generic_file_llseek).
> 
> Also looks it has been stated in Documentation/filesystems/Locking:
> 
> ->llseek() locking has moved from llseek to the individual llseek
> implementations.  If your fs is not using generic_file_llseek, you
> need to acquire and release the appropriate locks in your ->llseek().
> For many filesystems, it is probably safe to acquire the inode
> mutex or just to use i_size_read() instead.
> Note: this does not protect the file->f_pos against concurrent modifications
> since this is something the userspace has to take care about.
> 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/