JFFS2 has possible race when setting file attributes

JFFS2 has possible race when setting file attributes

[Dmitry Bazhenov]

Hello everybody!

It seems like there is a potential race in the function jffs2_do_setattr() in 
the case when attributes of a symlink are updated. The symlink metadata is 
read without having f->sem locked.
The following patch should fix the race.

--- a/fs/jffs2/fs.c     2006-04-29 18:51:53.000000000 +0400
+++ b/fs/jffs2/fs.c     2006-05-04 17:32:09.000000000 +0400
@@ -56,15 +56,20 @@ static int jffs2_do_setattr (struct inod
                mdatalen = sizeof(dev);
                D1(printk(KERN_DEBUG "jffs2_setattr(): Writing %d bytes of 
kdev_t\n", mdatalen));
        } else if (S_ISLNK(inode->i_mode)) {
+               down(&f->sem);
                mdatalen = f->metadata->size;
                mdata = kmalloc(f->metadata->size, GFP_USER);
-               if (!mdata)
+               if (!mdata) {
+                       up(&f->sem);
                        return -ENOMEM;
+               }
                ret = jffs2_read_dnode(c, f, f->metadata, mdata, 0, mdatalen);
                if (ret) {
+                       up(&f->sem);
                        kfree(mdata);
                        return ret;
                }
+               up(&f->sem);
                D1(printk(KERN_DEBUG "jffs2_setattr(): Writing %d bytes of 
symlink target\n", mdatalen));
        }


Regards,
Dmitry

Re: JFFS2 has possible race when setting file attributes

[David Woodhouse]

On Fri, 2006-05-05 at 10:50 +0400, Dmitry Bazhenov wrote:
> Hello everybody!
> 
> It seems like there is a potential race in the function jffs2_do_setattr() in 
> the case when attributes of a symlink are updated. The symlink metadata is 
> read without having f->sem locked.
> The following patch should fix the race.

Thanks. Please could you resend, including a 'Signed-off-by:' line?

-- 
dwmw2

Re: JFFS2 has possible race when setting file attributes

[Dmitry Bazhenov]

On Friday 05 May 2006 15:54, David Woodhouse wrote:
> Thanks. Please could you resend, including a 'Signed-off-by:' line?

I posted it to the list, but it didn't appear. So, I repost it.


It seems like there is a potential race in the function jffs2_do_setattr() in 
the case when attributes of a symlink are updated. The symlink metadata is 
read without having f->sem locked.
The following patch should fix the race.

Signed-off-by: Dmitry Bazhenov <atrey@emcraft.com>

--- a/fs/jffs2/fs.c     2006-04-29 18:51:53.000000000 +0400
+++ b/fs/jffs2/fs.c     2006-05-04 17:32:09.000000000 +0400
@@ -56,15 +56,20 @@ static int jffs2_do_setattr (struct inod
                mdatalen = sizeof(dev);
                D1(printk(KERN_DEBUG "jffs2_setattr(): Writing %d bytes of 
kdev_t\n", mdatalen));
        } else if (S_ISLNK(inode->i_mode)) {
+               down(&f->sem);
                mdatalen = f->metadata->size;
                mdata = kmalloc(f->metadata->size, GFP_USER);
-               if (!mdata)
+               if (!mdata) {
+                       up(&f->sem);
                        return -ENOMEM;
+               }
                ret = jffs2_read_dnode(c, f, f->metadata, mdata, 0, mdatalen);
                if (ret) {
+                       up(&f->sem);
                        kfree(mdata);
                        return ret;
                }
+               up(&f->sem);
                D1(printk(KERN_DEBUG "jffs2_setattr(): Writing %d bytes of 
symlink target\n", mdatalen));
        }

--
Dmitry