Skip to content
  • Linus Torvalds's avatar
    debugfs: fix u32_array race in format_array_alloc · e05e279e
    Linus Torvalds authored
    
    
    The format_array_alloc() function is fundamentally racy, in that it
    prints the array twice: once to figure out how much space to allocate
    for the buffer, and the second time to actually print out the data.
    
    If any of the array contents changes in between, the allocation size may
    be wrong, and the end result may be truncated in odd ways.
    
    Just don't do it.  Allocate a maximum-sized array up-front, and just
    format the array contents once.  The only user of the u32_array
    interfaces is the Xen spinlock statistics code, and it has 31 entries in
    the arrays, so the maximum size really isn't that big, and the end
    result is much simpler code without the bug.
    
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    e05e279e