[046/118] mm/swapfile.c: swap_next should increase position index

Commit Message

Andrew Morton Jan. 31, 2020, 6:13 a.m. UTC

From: Vasily Averin <[e-mail]>
Subject: mm/swapfile.c: swap_next should increase position index

If seq_file .next fuction does not change position index, read after some
lseek can generate unexpected output.

In Aug 2018 NeilBrown noticed commit 1f4aace60b0e ("fs/seq_file.c:
simplify seq_file iteration code and interface") "Some ->next functions do
not increment *pos when they return NULL...  Note that such ->next
functions are buggy and should be fixed.  A simple demonstration is

dd if=/proc/swaps bs=1000 skip=1

Choose any block size larger than the size of /proc/swaps.  This will
always show the whole last line of /proc/swaps"

Described problem is still actual.  If you make lseek into middle of last
output line following read will output end of last line and whole last
line once again.

$ dd if=/proc/swaps bs=1  # usual output
Filename				Type		Size	Used	Priority
/dev/dm-0                               partition	4194812	97536	-2
104+0 records in
104+0 records out
104 bytes copied

$ dd if=/proc/swaps bs=40 skip=1    # last line was generated twice
dd: /proc/swaps: cannot skip to specified offset
v/dm-0                               partition	4194812	97536	-2
/dev/dm-0                               partition	4194812	97536	-2
3+1 records in
3+1 records out
131 bytes copied

https://bugzilla.kernel.org/show_bug.cgi?id=206283

Link: http://lkml.kernel.org/r/[e-mail]
Signed-off-by: Vasily Averin <[e-mail]>
Reviewed-by: Andrew Morton <[e-mail]>
Cc: Jann Horn <[e-mail]>
Cc: Alexander Viro <[e-mail]>
Cc: Kees Cook <[e-mail]>
Cc: Hugh Dickins <[e-mail]>
Signed-off-by: Andrew Morton <[e-mail]>
---

 mm/swapfile.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch

--- a/mm/swapfile.c~swap_next-should-increase-position-index
+++ a/mm/swapfile.c
@@ -2737,10 +2737,10 @@  static void *swap_next(struct seq_file *
 	else
 		type = si->type + 1;
 
+	++(*pos);
 	for (; (si = swap_type_to_swap_info(type)); type++) {
 		if (!(si->flags & SWP_USED) || !si->swap_map)
 			continue;
-		++*pos;
 		return si;
 	}