Re: [RFC] copy_from_user races with readpage

[Neil Brown]

On Wednesday April 19, akpm@xxxxxxxx wrote:
> 
> The application is being a bit silly, because the read will return
> indeterminate results depending on whether it gets there before or after
> the write.  But that's assuming that the read is reading the part of the
> page which the writer is writing.  If the reader is reading bytes 1000-1010
> and the writer is writing bytes 990-1000 then the reader is being non-silly
> and would be justifiably surprised to see zeroes.

However this non-silly case will not cause a problem.  If the write is
writing bytes 990-1000, then only those bytes risk being zeroed by
__copy_from_user.  Bytes 1000-1010 (assuming those ranges are intended
not to overlap) will not be at risk.

> 
> 
> I'd have thought that a sufficient fix would be to change
> __copy_from_user_inatomic() to not do the zeroing, then review all users to
> make sure that they cannot leak uninitialised memory.

I would agree with this.

NeilBrown
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/