lkml.org 
[lkml]   [2008]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: file offset corruption on 32-bit machines?
> On Thu, Apr 10, 2008 at 04:31:09PM +0200, Jiri Kosina wrote:
> > > Well, this race is more subtle - the window is just one instruction
> > > wide (stores to f_pos from CPU2 must come between the store of lower and
> > > upper 32-bits of f_pos on CPU1). And the only result is that f_pos has
> > > 32-bits from one file pointer and 32-bits from the other one. So I can
> > > hardly imagine this would be exploitable...
> >
> > Supposing you are not holding any spinlock and are running with
> > preemptible kernel (pretty common scenario nowadays), there is nothing
> > that would prevent kernel from rescheduling between the two instructions,
> > enlarging the race window to be more comfortable for attacker, right?
> >
> > I think this is worth fixing.
>
> Seems a lot like reading jiffies to me. Is the seqlock the right
> solution to use for fixing this?
You can get your inspiration in the implementation of i_size_read()
and i_size_write() functions :). They deal with exactly the same problem.
But in the case of f_pos, the number of readers and writers is balanced so
maybe a spinlock would be fine as well...

Honza
--
Jan Kara <jack@suse.cz>
SuSE CR Labs


\
 
 \ /
  Last update: 2008-04-10 17:25    [W:0.070 / U:0.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site