Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-13 16:35:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fs/cromfs: Fix stale cache read in read() fast path.

Browse source 
cromfs_read()'s fast path decompresses a block directly into the
caller's buffer whenever a read reaches a block at its start and the
caller has room for the whole decompressed block, bypassing the
per-file decompression cache (ff_buffer). It nonetheless marked that
block as cached by setting ff_offset, without ever writing ff_buffer
itself.

A later read of the same block that fell onto the slow path trusted
that false cache tag, skipped decompression, and copied from
ff_buffer without it ever having been populated for that block. A
repeated identical fast-path read of the same block hit the same
false tag and skipped decompression entirely, leaving the caller's
buffer untouched and returning whatever was already there.

Fixed by having the fast path only read the cache, never populate it:
reuse ff_buffer when a prior slow-path read already cached the same
block, otherwise decompress straight into the caller's buffer without
touching ff_offset/ff_buffer.

Co-authored-by: Pavlo
Assisted-by: Claude Code:claude-sonnet-5
Signed-off-by: alexcekay <alexander@auterion.com>
This commit is contained in:
alexcekay 2026-08-12 11:49:14 +02:00 • committed by Alan C. Assis
parent 4977c28a3f
commit a450392da5
1 changed files with 13 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

22
fs/cromfs/fs_cromfs.c
View file

@ -997,26 +997,30 @@ static ssize_t cromfs_read(FAR struct file *filep, FAR char *buffer,
/* Get the address and offset in the CROMFS image to obtain
* the data. Check if we already have this offset in the
* cache.
* cache. This path decompresses into the caller's buffer,
* not into ff_buffer, so it may only read the cache, never
* populate it.
*/
src = (FAR const uint8_t *)currhdr + LZF_TYPE1_HDR_SIZE;
src = (FAR const uint8_t *)currhdr + LZF_TYPE1_HDR_SIZE;
voloffs = cromfs_addr2offset(fs, src);
if (voloffs != ff->ff_offset)
if (voloffs == ff->ff_offset)
{
DEBUGASSERT(ff->ff_ulen >= copysize);
memcpy(dest, ff->ff_buffer, copysize);
}
else
{
unsigned int decomplen;
decomplen = lzf_decompress(src, complen, dest,
fs->cv_bsize);
ff->ff_offset = voloffs;
ff->ff_ulen = decomplen;
DEBUGASSERT(decomplen >= copysize);
}
finfo("voloffs=%" PRIu32 " blkoffs=%" PRIu32
" ulen=%" PRIu16 " ff_offset=%" PRIu32 " copysize=%u\n",
voloffs, blkoffs, ulen, ff->ff_offset, copysize);
DEBUGASSERT(ff->ff_ulen >= copysize);
" ulen=%" PRIu16 " copysize=%u\n",
voloffs, blkoffs, ulen, copysize);
}
else
{