Messages in this thread | | | Date | Fri, 25 Jan 2013 00:25:53 +0000 | From | Al Viro <> | Subject | [RFC] efivars write(2) races |
| |
1) process A does write() on efivars file, reaches ->get_variable(), gets newdatasize set, drops efivars->lock and loses CPU before an attempt to grab ->i_mutex. process B comes and does the same thing, replacing the variable contents. Then it grabs ->i_mutex, updates size, drops ->i_mutex and buggers off. At which point A gets CPU back and proceeds to set size to whatever would be valid for its write. Only the value is bogus now...
2) what's to prevent EFI_NOT_FOUND being hit twice? Bad things will obviously happen in that case...
| |