Commit 36048853 authored by David Rientjes's avatar David Rientjes Committed by Linus Torvalds

debugfs: fix race in u32_array_read and allocate array at open

u32_array_open() is racy when multiple threads read from a file with a
seek position of zero, i.e. when two or more simultaneous reads are
occurring after the non-seekable files are created.  It is possible that
file->private_data is double-freed because the threads races between

	kfree(file->private-data);

and

	file->private_data = NULL;

The fix is to only do format_array_alloc() when the file is opened and
free it when it is closed.

Note that because the file has always been non-seekable, you can't open
it and read it multiple times anyway, so the data has always been
generated just once.  The difference is that now it is generated at open
time rather than at the time of the first read, and that avoids the
race.
Reported-by: default avatarDave Jones <davej@redhat.com>
Acked-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Tested-by: default avatarRaghavendra <raghavendra.kt@linux.vnet.ibm.com>
Signed-off-by: default avatarDavid Rientjes <rientjes@google.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent c46de226
...@@ -526,12 +526,6 @@ struct array_data { ...@@ -526,12 +526,6 @@ struct array_data {
u32 elements; u32 elements;
}; };
static int u32_array_open(struct inode *inode, struct file *file)
{
file->private_data = NULL;
return nonseekable_open(inode, file);
}
static size_t format_array(char *buf, size_t bufsize, const char *fmt, static size_t format_array(char *buf, size_t bufsize, const char *fmt,
u32 *array, u32 array_size) u32 *array, u32 array_size)
{ {
...@@ -573,26 +567,21 @@ static char *format_array_alloc(const char *fmt, u32 *array, ...@@ -573,26 +567,21 @@ static char *format_array_alloc(const char *fmt, u32 *array,
return ret; return ret;
} }
static ssize_t u32_array_read(struct file *file, char __user *buf, size_t len, static int u32_array_open(struct inode *inode, struct file *file)
loff_t *ppos)
{ {
struct inode *inode = file->f_path.dentry->d_inode;
struct array_data *data = inode->i_private; struct array_data *data = inode->i_private;
size_t size;
if (*ppos == 0) { file->private_data = format_array_alloc("%u", data->array,
if (file->private_data) { data->elements);
kfree(file->private_data); if (!file->private_data)
file->private_data = NULL; return -ENOMEM;
} return nonseekable_open(inode, file);
}
file->private_data = format_array_alloc("%u", data->array,
data->elements);
}
size = 0; static ssize_t u32_array_read(struct file *file, char __user *buf, size_t len,
if (file->private_data) loff_t *ppos)
size = strlen(file->private_data); {
size_t size = strlen(file->private_data);
return simple_read_from_buffer(buf, len, ppos, return simple_read_from_buffer(buf, len, ppos,
file->private_data, size); file->private_data, size);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment