lkml.org 
[lkml]   [2013]   [Apr]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Yet another pipe related oops.
    On Tue, Apr 02, 2013 at 01:22:04AM +0100, Al Viro wrote:
    > On Tue, Apr 02, 2013 at 12:27:18AM +0100, Al Viro wrote:
    > > On Mon, Apr 01, 2013 at 02:44:36PM -0700, Greg Kroah-Hartman wrote:
    > > > > > I guess you are right, it will not. I guess we need to do what
    > > > > > character devices do and have an "intermediate" fops in order to protect
    > > > > > this. Would that work?
    > > > >
    > > > > You mean, with reassigning ->f_op in ->open()? That'll work, as long as
    > > > > we have exclusion between removal and fetching the sucker in primary
    > > > > ->open()... Where would you prefer to stash fops?
    > > >
    > > > Ick, that's not going to work as the current api just uses a fops and
    > > > debugfs doesn't keep anything else hanging around that referes to
    > > > something "before" that, like 'struct cdev' does.
    > >
    > > Er? How about just sticking it into dentry->d_fsdata and letting
    > > debugfs_remove() zero that out? What am I missing here?

    Nothing, you are right, that would work just fine. Want me to fix it
    up, or do you want to?

    > Hrm... For what it's worth, how do debugfs entries associated with
    > dynamic objects deal with debugfs_remove() vs. method calls? I don't
    > see _anything_ in {,__}debugfs_remove() that would looks like "wait
    > for ongoing write(2) attempts to complete". IOW, forget rmmod - WTF
    > protects us from access-after-free for any kind of data that isn't
    > permanently allocated?

    Nothing protects you from that, that's what I was trying to get at with
    the dynamic attributes comment.

    greg k-h


    \
     
     \ /
      Last update: 2013-04-02 04:01    [W:3.285 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site