linux-kernel - Re: [PATCH] fs: configfs: don't set buffer_needs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Jul 2016 21:23:34 +0300
From:	Tal Shorer <tal.shorer@...il.com>
To:	Joel Becker <jlbec@...lplan.org>, hch@....de,
	"<linux-kernel@...r.kernel.org>" <linux-kernel@...r.kernel.org>
Cc:	Tal Shorer <tal.shorer@...il.com>
Subject: Re: [PATCH] fs: configfs: don't set buffer_needs_fill to zero if
 show() returns error

On Fri, Jul 1, 2016 at 12:28 PM, Tal Shorer <tal.shorer@...il.com> wrote:
> A confgifs attribute's show() callback is called once the first time
> the user attempts to read from it. If it returns an error, that
> error is returned to the user. However, the open file's
> buffer_needs_fill is still set to zero and consecutive read() calls
> will find an empty buffer that doesn't need filling and return 0 to
> the user. This could give the user the wrong impression that the
> attribute was read successfully.
>
> Fix this by not setting buffer_needs_fill if show() returns an error,
> making consecutive read() calls call show() again and either get an
> error again or get data.
>
> Signed-off-by: Tal Shorer <tal.shorer@...il.com>
> ---
>  fs/configfs/file.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/fs/configfs/file.c b/fs/configfs/file.c
> index 33b7ee3..68645c9 100644
> --- a/fs/configfs/file.c
> +++ b/fs/configfs/file.c
> @@ -80,11 +80,11 @@ static int fill_read_buffer(struct dentry * dentry, struct configfs_buffer * buf
>
>         count = attr->show(item, buffer->page);
>
> -       buffer->needs_read_fill = 0;
>         BUG_ON(count > (ssize_t)SIMPLE_ATTR_SIZE);
> -       if (count >= 0)
> +       if (count >= 0) {
> +               buffer->needs_read_fill = 0;
>                 buffer->count = count;
> -       else
> +       } else
>                 ret = count;
>         return ret;
>  }
> --
> 2.7.4
>
Ping?