Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c038ae62 authored by Pengcheng Yang's avatar Pengcheng Yang Committed by Greg Kroah-Hartman
Browse files

kernel/relay.c: fix read_pos error when multiple readers 



[ Upstream commit 341a7213e5c1ce274cc0f02270054905800ea660 ]

When reading, read_pos should start with bytes_consumed, not file->f_pos.
Because when there is more than one reader, the read_pos corresponding to
file->f_pos may have been consumed, which will cause the data that has
been consumed to be read and the bytes_consumed update error.

Signed-off-by: default avatarPengcheng Yang <yangpc@wangsu.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Reviewed-by: default avatarJens Axboe <axboe@kernel.dk>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jann Horn <jannh@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>e
Link: http://lkml.kernel.org/r/1579691175-28949-1-git-send-email-yangpc@wangsu.com


Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Stable-dep-of: 43ec16f1450f ("relayfs: fix out-of-bounds access in relay_file_read")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 4f4de392

kernel/relay.c

+7 −10
Original line number Diff line number Diff line
@@ -997,14 +997,14 @@ static void relay_file_read_consume(struct rchan_buf *buf, 
/*

 *	relay_file_read_avail - boolean, are there unconsumed bytes available?

 */

static int relay_file_read_avail(struct rchan_buf *buf, size_t read_pos)

static int relay_file_read_avail(struct rchan_buf *buf)

{

	size_t subbuf_size = buf->chan->subbuf_size;

	size_t n_subbufs = buf->chan->n_subbufs;

	size_t produced = buf->subbufs_produced;

	size_t consumed = buf->subbufs_consumed;



	relay_file_read_consume(buf, read_pos, 0);

	relay_file_read_consume(buf, 0, 0);



	consumed = buf->subbufs_consumed;
@@ -1065,23 +1065,20 @@ static size_t relay_file_read_subbuf_avail(size_t read_pos, 


/**

 *	relay_file_read_start_pos - find the first available byte to read

 *	@read_pos: file read position

 *	@buf: relay channel buffer

 *

 *	If the @read_pos is in the middle of padding, return the

 *	If the read_pos is in the middle of padding, return the

 *	position of the first actually available byte, otherwise

 *	return the original value.

 */

static size_t relay_file_read_start_pos(size_t read_pos,

					struct rchan_buf *buf)

static size_t relay_file_read_start_pos(struct rchan_buf *buf)

{

	size_t read_subbuf, padding, padding_start, padding_end;

	size_t subbuf_size = buf->chan->subbuf_size;

	size_t n_subbufs = buf->chan->n_subbufs;

	size_t consumed = buf->subbufs_consumed % n_subbufs;

	size_t read_pos = consumed * subbuf_size + buf->bytes_consumed;



	if (!read_pos)

		read_pos = consumed * subbuf_size + buf->bytes_consumed;

	read_subbuf = read_pos / subbuf_size;

	padding = buf->padding[read_subbuf];

	padding_start = (read_subbuf + 1) * subbuf_size - padding;
@@ -1137,10 +1134,10 @@ static ssize_t relay_file_read(struct file *filp, 
	do {

		void *from;



		if (!relay_file_read_avail(buf, *ppos))

		if (!relay_file_read_avail(buf))

			break;



		read_start = relay_file_read_start_pos(*ppos, buf);

		read_start = relay_file_read_start_pos(buf);

		avail = relay_file_read_subbuf_avail(read_start, buf);

		if (!avail)

			break;