From: 石祤 <linxiulei@gmail.com>
To: leilei.lin@alibaba-inc.com, viro@zeniv.linux.org.uk,
linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
zhiche.yy@alibaba-inc.com
Subject: [PATCH 0/2] fsnotify: fix mem overwritten
Date: Wed, 31 May 2017 11:54:21 +0800 [thread overview]
Message-ID: <20170531035423.70970-1-leilei.lin@alibaba-inc.com> (raw)
From: "leilei.lin" <leilei.lin@alibaba-inc.com>
Slub alloced mem overwritten ocurrs when fsnotify thread was copying the
dentry name and another rename thread change the dentry name at same
time.
These patches do the following:
1. A new copy_dname method was created which copy file_name to new alloc mem.
The later patch (of 2) would use this method
2. Use the new copy_dname method instead of using the point of dentry->name,
which may be modified anytime
We can use script below to reproduce overwritten warning
```
#!/usr/bin/python
import os
import random
import time
import string
import multiprocessing
WRITE_SIZE = 100
filename = "/watch/tdc_admin.LOG"
#filename = "/watch/tdc_admin.LOG.1234567890.1234567890.1234567890"
def file_op_process():
for j in range(10):
n = random.randrange(0, 10)
tobe_wrote = "".join(random.sample(string.ascii_letters, 10))
for i in xrange(n):
try:
os.rename(filename, filename + ".1123123123")
except OSError:
pass
for i in xrange(n):
f = file(filename, "w+")
f.write(tobe_wrote * i * (1024 / 2))
f.flush()
f.close()
if __name__ == '__main__':
process_list = []
while True:
for i in range(100):
p0 = multiprocessing.Process(target=file_op_process)
p0.start()
process_list.append(p0)
#time.sleep(0.002)
for p in process_list:
if p.is_alive():
p.join(0.01)
else:
del p
```
leilei.lin (2):
fs/dcache.c: New copy_dname method
fsnotify: use method copy_dname copying filename
fs/dcache.c | 36 ++++++++++++++++++++++++++++++++++++
fs/notify/fsnotify.c | 14 ++++++++++++--
include/linux/dcache.h | 2 ++
3 files changed, 50 insertions(+), 2 deletions(-)
--
2.8.4.31.g9ed660f
next reply other threads:[~2017-05-31 3:54 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-31 3:54 石祤 [this message]
2017-05-31 3:54 ` [PATCH 1/2] fs/dcache.c: New copy_dname method 石祤
2017-05-31 3:54 ` [PATCH 2/2] fsnotify: use method copy_dname copying filename 石祤
2017-08-04 3:58 ` 林守磊
2017-08-04 3:58 ` 林守磊
2017-08-04 5:18 ` Al Viro
2017-08-04 5:18 ` Al Viro
2017-08-04 5:18 ` Al Viro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170531035423.70970-1-leilei.lin@alibaba-inc.com \
--to=linxiulei@gmail.com \
--cc=leilei.lin@alibaba-inc.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
--cc=zhiche.yy@alibaba-inc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.