Subject: bug#11100: closed (Re: bug#11100: Racy code in copy.c)

From: [email-masked] (GNU bug Tracking System)
Date: Mon, 07 May 2012 11:45:03 +0000

Your bug report

#11100: Racy code in copy.c

which was filed against the coreutils package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
11100: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=11100
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#11100: Racy code in copy.c
From: Jim Meyering <[email-masked]>
To: Philipp Thomas <[email-masked]>
Cc: [email-masked]
Date: Mon, 07 May 2012 13:41:57 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Philipp Thomas wrote:
> * Jim Meyering ([email-masked]) [20120504 17:30]:
>
>> If there's a bugzilla reference for this, let me know
>> and I'll add it to the commit log.
>
> There is, but as it's a SLES bug it's only open for SUSE employees and
> customers and thus useless for a coreutils commit log. I'll instead
> reference the commit from said bug report.

Ok.  I've pushed that change.

Subject: Racy code in copy.c
From: Philipp Thomas <[email-masked]>
To: [email-masked]
Cc: Neil F Brown <[email-masked]>
Date: Tue, 27 Mar 2012 14:58:18 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

I'd like to pass on observations from my collegue Neil Brown:

in src/copy.c, copy_reg() is passed "bool *new_dst".

This is 'false' if the file already exists, in which case it attempts to
open the file with O_WRONLY | O_TRUNC | O_BINARY.
If it is 'true', only then does it use O_CREAT (and others).

Somewhere up the call chain - I'm not sure where - new_dst is set if 'stat'
on the file succeeds.  The above mentioned code assumes that the file still
exists.  This is racy - particularly for NFS where deletions from other
clients can take a while to appear.

Philipp