Re: [PATCH] /proc/kcore: fix seeking

[Frederic Weisbecker <fweisbec@gmail.com>]

On Fri, Jan 14, 2011 at 05:44:42PM +0800, Américo Wang wrote:
> On Tue, Jan 11, 2011 at 05:23:23PM +0100, Frederic Weisbecker wrote:
> >On Wed, Jan 12, 2011 at 12:04:37AM +0800, Américo Wang wrote:
> >> On Mon, Jan 10, 2011 at 09:42:29AM -0500, Dave Anderson wrote:
> >> >From: Dave Anderson <anderson@redhat.com>
> >> >
> >> >Commit 34aacb2920667d405a8df15968b7f71ba46c8f18
> >> >("procfs: Use generic_file_llseek in /proc/kcore")
> >> >broke seeking on /proc/kcore.  This changes it back
> >> >to use default_llseek in order to restore the original
> >> >behavior.
> >> >
> >> >The problem with generic_file_llseek is that it only
> >> >allows seeks up to inode->i_sb->s_maxbytes, which is
> >> >2GB-1 on procfs, where the memory file offset values in
> >> >the /proc/kcore PT_LOAD segments may exceed or start
> >> >beyond that offset value.
> >> >
> >> 
> >> Is the race solved? Using default_llseek() still races
> >> with read_kcore() on fpos, AFAIK.
> >
> >Hmm, how does it race there?
> >
> >read_kcore() manipulates fpos, which can't be changed behind
> >us inside the read callback as it's a snapshot. Also read_kcore()
> >can change the value of fpos, which is writed back to file->fpos
> >from sys_read().
> >
> >So the last resulting race here the natural one between
> >seeking and reading, which is up to the user to take care
> >of.
> 
> Hmm, I just read the changelog of commit
> 34aacb2920667d405a8df15968b7f71ba46c8f18, which claims to fix
> the race. So anything changed in vfs layer after that?


Ah it didn't fix any race, it just got rid of the bkl, OTOH
I said in my changelog:

	"/proc/kcore has no llseek and then falls down to use default_llseek.
	This is racy against read_kcore() that directly manipulates fpos
	but it doesn't hold the bkl there so using it in llseek doesn't
	protect anything."

So I think this just testifies my crude misunderstanding of the code when I wrote
that changelog. I didn't realize fpos is a copy of the file offset that is writed back
later. Hence my changelog was buggy.