nuttx/fs/vfs
dongjiuzhu1 148f0ce7dd fs/inode: use file_allocate,file_dup to avoid racecondition to allocate fd
issue description:
task A:                                            NSH:
1.open->                                           reboot->sync->task_fsfsync
2.nx_vopen->               context switch
3.fdlist_allocate:            ---->                4.fsync->file_sync->assert(inode or priv is empty)
(new fd with empty filep)
5.file_vopen:
(init empty filep)
6.return fd

Task A allocates a new fd with an empty filep in fdlist_allocate. Before
it can fully initialize the filep in file_vopen, the NSH task triggers a
file - system sync operation. The sync operation encounters the empty
filep associated with the newly allocated fd, causing the assertion to
fail and the system to crash.

To resolve this race condition, we should modify the fd allocation
process. Instead of allocating a new fd with an empty filep first and
then initializing it later, we should use the file_allocate_from_inode
function. This function allows us to initialize the file structure first
and then bind it to the new filep when allocating the fd. By doing so,
we ensure that the filep is always properly initialized before it is
used in any file - system operations, thus preventing the assertion
failure and the subsequent system crash.

Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
2026-01-09 17:11:25 +08:00
..
CMakeLists.txt fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_chstat.c fs: migrate to SPDX identifier 2024-11-06 01:58:54 +08:00
fs_close.c fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_dir.c style: fix spelling in code comments and strings 2025-05-23 10:48:41 +08:00
fs_dup.c fs/vfs: Separate file descriptors from file descriptions 2025-06-12 18:12:42 +08:00
fs_dup2.c fs/vfs: fix bug about lost dup oflags in dup2 2025-07-15 19:46:24 +08:00
fs_dup3.c fs/vfs: Separate file descriptors from file descriptions 2025-06-12 18:12:42 +08:00
fs_epoll.c fs/epoll: add TLS cleanup handler to release epoll fd reference on thread exit 2025-12-31 08:49:04 -03:00
fs_eventfd.c fs/eventfd/timerfd: update sem next to avoid busy loop 2026-01-02 07:55:37 -03:00
fs_fchstat.c fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_fcntl.c fs/fcntl: using ioctl to implement FIOGCLEX/FIOCLEX/FIONCLEX 2025-06-15 07:12:44 -03:00
fs_fstat.c fs/file: unify prefix about file_xxx api, like file_open, file_ioctl 2025-06-12 18:12:42 +08:00
fs_fstatfs.c fs/file: unify prefix about file_xxx api, like file_open, file_ioctl 2025-06-12 18:12:42 +08:00
fs_fsync.c fs/file: unify prefix about file_xxx api, like file_open, file_ioctl 2025-06-12 18:12:42 +08:00
fs_inotify.c fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_ioctl.c fs/vfs: Rename lock.h to vfs.h 2025-06-23 18:17:10 -03:00
fs_link.c fs: migrate to SPDX identifier 2024-11-06 01:58:54 +08:00
fs_lock.c fs/lock: Allow driver lock 2025-08-12 20:17:06 +08:00
fs_lseek.c fs/file: unify prefix about file_xxx api, like file_open, file_ioctl 2025-06-12 18:12:42 +08:00
fs_mkdir.c fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_open.c fs/inode: use file_allocate,file_dup to avoid racecondition to allocate fd 2026-01-09 17:11:25 +08:00
fs_poll.c poll: fix covertify issue about out-of-bound access fds 2025-12-15 10:16:05 +08:00
fs_pread.c fs/file: unify prefix about file_xxx api, like file_open, file_ioctl 2025-06-12 18:12:42 +08:00
fs_pseudofile.c fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_pwrite.c fs/file: unify prefix about file_xxx api, like file_open, file_ioctl 2025-06-12 18:12:42 +08:00
fs_read.c fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_readlink.c fs: migrate to SPDX identifier 2024-11-06 01:58:54 +08:00
fs_rename.c fs/vfs/fs_rename: fix directory move operation. 2025-07-31 01:53:59 +08:00
fs_rmdir.c fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_select.c select: fix too small timeout will be counted as 0 2025-12-06 17:46:20 +08:00
fs_sendfile.c fs/file: unify prefix about file_xxx api, like file_open, file_ioctl 2025-06-12 18:12:42 +08:00
fs_signalfd.c sched/signal: Fix nxsig_ismember() return value behavior 2025-11-25 10:02:52 +08:00
fs_stat.c fs/fs.h: Add register_driver_with_size function 2025-11-13 08:57:52 -03:00
fs_statfs.c fs: migrate to SPDX identifier 2024-11-06 01:58:54 +08:00
fs_symlink.c fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_syncfs.c fs/file: unify prefix about file_xxx api, like file_open, file_ioctl 2025-06-12 18:12:42 +08:00
fs_timerfd.c fs/eventfd/timerfd: update sem next to avoid busy loop 2026-01-02 07:55:37 -03:00
fs_truncate.c fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_uio.c fs/uio: do not overwrite the return value 2025-01-22 16:45:46 +08:00
fs_unlink.c fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
fs_write.c bugfix/fs:write Bad buf addr should return EINVAL 2025-12-16 19:41:19 +08:00
Kconfig fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
Make.defs fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00
vfs.h fs: Move inotify.c from fs/notify/ to fs/vfs/ 2025-06-23 18:17:10 -03:00