[GIT PULL] pipe: Notification queue preparation

Linus Torvalds torvalds at linux-foundation.org
Thu Dec 5 17:24:51 UTC 2019


On Thu, Dec 5, 2019 at 9:12 AM Linus Torvalds
<torvalds at linux-foundation.org> wrote:
>
> It would be interesting to hear if somebody else is waiting on the
> read side too.

Looking once more at that commit, I find at least one bug, but I'm
pretty sure that's not the cause of this problem.

DavidH, watch out for things like this:

-       for (idx = 0; idx < pipe->nrbufs && rem < len; idx++)
+       for (idx = tail; idx < head && rem < len; idx++)

which is a completely buggy conversion.

You can't compare tail and head with an inequality, it gets the
wraparound case wrong.

But I found only one of those, and it's fuse-specific, plus the
overflow would take a long time to trigger, so I'm pretty sure this
isn't what DavidS is reporting.

               Linus



More information about the Linux-security-module-archive mailing list