Messages in this thread | | | Date | Fri, 24 Jan 2014 14:42:53 +0100 | From | Denys Vlasenko <> | Subject | Re: [PATCH] dcache: fix locking bug in __dentry_path() |
| |
On 01/24/2014 01:24 PM, Al Viro wrote: > On Fri, Jan 24, 2014 at 11:21:26AM +0100, Denys Vlasenko wrote: >> If given buffer size is zero, we forget to rcu_read_unlock() >> on error path. > > Er... Where could we ever get called with size zero? IOW, the > real question is whether that check makes any sense. If nothing > else, a much more obvious fix (again, assuming there is a call > chain that could have triggered that in the first place), would > be to take that > if (buflen < 1) > goto Elong; > on the very top of __dentry_path(). Note that buflen never > change, so this check could bloody well be handled once - and > earlier.
Yes. In fact the check is buggier than I thought:
prepend(&end, &len, "\0", 1); if (buflen < 1) goto Elong; /* Get '/' right */ retval = end-1; *retval = '/'; <=== !!!
It should be "buflen < 2". With buflen == 1, we touch buffer[-1].
> But again, the callers shouldn't be calling it that > way...
I'll add a check in d_path() and post another patch. I assume the assertion should be 'size >= 2', since path "" should never be produced anyway, the shortest path is "/"?
-- vda
| |