Potential data race on the file->f_pos field between getdents and sendfile

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi VFS developers,

I am posting here a potential data race on the file->f_pos field
between getdents and sendfile. Following is the trace:

[Setup]
mkdir("foo", 511) = 0;
open("foo", 65536, 511) = 3;
dup2(3, 199) = 199;

create("bar", 511) = 4;
dup2(4, 198) = 198;

[Thread 1]
getdents(199, [some buffer], 3874);

__do_sys_getdents
  iterate_dir
    [WRITE] file->f_pos = ctx->pos;

[Thread 2]
sendfile(198, 199, NULL, 2163);

__do_sys_sendfile64
  do_sendfile
    [READ] pos = in.file->f_pos;

This may be a false data race, i.e., the behavior could be allowed by
POSIX as user might want to sendfile to a dirfd while the dirfd is
being iterated (although there is no obvious reason for doing so). I
am posting this here for more visibility and feel free to comment.

Best Regards,
Meng



[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]

  Powered by Linux