This is an automated email from the ASF dual-hosted git repository.
acassis pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new a450392da55 fs/cromfs: Fix stale cache read in read() fast path.
a450392da55 is described below
commit a450392da554bf12d991bfef6ef30ec117a8a2a0
Author: alexcekay <[email protected]>
AuthorDate: Wed Aug 12 11:49:14 2026 +0200
fs/cromfs: Fix stale cache read in read() fast path.
cromfs_read()'s fast path decompresses a block directly into the
caller's buffer whenever a read reaches a block at its start and the
caller has room for the whole decompressed block, bypassing the
per-file decompression cache (ff_buffer). It nonetheless marked that
block as cached by setting ff_offset, without ever writing ff_buffer
itself.
A later read of the same block that fell onto the slow path trusted
that false cache tag, skipped decompression, and copied from
ff_buffer without it ever having been populated for that block. A
repeated identical fast-path read of the same block hit the same
false tag and skipped decompression entirely, leaving the caller's
buffer untouched and returning whatever was already there.
Fixed by having the fast path only read the cache, never populate it:
reuse ff_buffer when a prior slow-path read already cached the same
block, otherwise decompress straight into the caller's buffer without
touching ff_offset/ff_buffer.
Co-authored-by: Pavlo
Assisted-by: Claude Code:claude-sonnet-5
Signed-off-by: alexcekay <[email protected]>
---
fs/cromfs/fs_cromfs.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/fs/cromfs/fs_cromfs.c b/fs/cromfs/fs_cromfs.c
index c82b75a4317..c78f6113843 100644
--- a/fs/cromfs/fs_cromfs.c
+++ b/fs/cromfs/fs_cromfs.c
@@ -997,26 +997,30 @@ static ssize_t cromfs_read(FAR struct file *filep, FAR
char *buffer,
/* Get the address and offset in the CROMFS image to obtain
* the data. Check if we already have this offset in the
- * cache.
+ * cache. This path decompresses into the caller's buffer,
+ * not into ff_buffer, so it may only read the cache, never
+ * populate it.
*/
- src = (FAR const uint8_t *)currhdr + LZF_TYPE1_HDR_SIZE;
+ src = (FAR const uint8_t *)currhdr + LZF_TYPE1_HDR_SIZE;
voloffs = cromfs_addr2offset(fs, src);
- if (voloffs != ff->ff_offset)
+ if (voloffs == ff->ff_offset)
+ {
+ DEBUGASSERT(ff->ff_ulen >= copysize);
+ memcpy(dest, ff->ff_buffer, copysize);
+ }
+ else
{
unsigned int decomplen;
decomplen = lzf_decompress(src, complen, dest,
fs->cv_bsize);
-
- ff->ff_offset = voloffs;
- ff->ff_ulen = decomplen;
+ DEBUGASSERT(decomplen >= copysize);
}
finfo("voloffs=%" PRIu32 " blkoffs=%" PRIu32
- " ulen=%" PRIu16 " ff_offset=%" PRIu32 " copysize=%u\n",
- voloffs, blkoffs, ulen, ff->ff_offset, copysize);
- DEBUGASSERT(ff->ff_ulen >= copysize);
+ " ulen=%" PRIu16 " copysize=%u\n",
+ voloffs, blkoffs, ulen, copysize);
}
else
{
