This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch releases/13.0
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/releases/13.0 by this push:
new 2688f948c77 fs/cromfs: Fix stale cache read in read() fast path.
2688f948c77 is described below
commit 2688f948c775a5ec1604479193097bd4837bbc4b
Author: alexcekay <[email protected]>
AuthorDate: Wed Aug 12 11:49:14 2026 +0200
fs/cromfs: Fix stale cache read in read() fast path.
cromfs_read()'s fast path decompresses a block directly into the
caller's buffer whenever a read reaches a block at its start and the
caller has room for the whole decompressed block, bypassing the
per-file decompression cache (ff_buffer). It nonetheless marked that
block as cached by setting ff_offset, without ever writing ff_buffer
itself.
A later read of the same block that fell onto the slow path trusted
that false cache tag, skipped decompression, and copied from
ff_buffer without it ever having been populated for that block. A
repeated identical fast-path read of the same block hit the same
false tag and skipped decompression entirely, leaving the caller's
buffer untouched and returning whatever was already there.
Fixed by having the fast path only read the cache, never populate it:
reuse ff_buffer when a prior slow-path read already cached the same
block, otherwise decompress straight into the caller's buffer without
touching ff_offset/ff_buffer.
Co-authored-by: Pavlo
Assisted-by: Claude Code:claude-sonnet-5
Signed-off-by: alexcekay <[email protected]>
---
fs/cromfs/fs_cromfs.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/fs/cromfs/fs_cromfs.c b/fs/cromfs/fs_cromfs.c
index c82b75a4317..c78f6113843 100644
--- a/fs/cromfs/fs_cromfs.c
+++ b/fs/cromfs/fs_cromfs.c
@@ -997,26 +997,30 @@ static ssize_t cromfs_read(FAR struct file *filep, FAR
char *buffer,
/* Get the address and offset in the CROMFS image to obtain
* the data. Check if we already have this offset in the
- * cache.
+ * cache. This path decompresses into the caller's buffer,
+ * not into ff_buffer, so it may only read the cache, never
+ * populate it.
*/
- src = (FAR const uint8_t *)currhdr + LZF_TYPE1_HDR_SIZE;
+ src = (FAR const uint8_t *)currhdr + LZF_TYPE1_HDR_SIZE;
voloffs = cromfs_addr2offset(fs, src);
- if (voloffs != ff->ff_offset)
+ if (voloffs == ff->ff_offset)
+ {
+ DEBUGASSERT(ff->ff_ulen >= copysize);
+ memcpy(dest, ff->ff_buffer, copysize);
+ }
+ else
{
unsigned int decomplen;
decomplen = lzf_decompress(src, complen, dest,
fs->cv_bsize);
-
- ff->ff_offset = voloffs;
- ff->ff_ulen = decomplen;
+ DEBUGASSERT(decomplen >= copysize);
}
finfo("voloffs=%" PRIu32 " blkoffs=%" PRIu32
- " ulen=%" PRIu16 " ff_offset=%" PRIu32 " copysize=%u\n",
- voloffs, blkoffs, ulen, ff->ff_offset, copysize);
- DEBUGASSERT(ff->ff_ulen >= copysize);
+ " ulen=%" PRIu16 " copysize=%u\n",
+ voloffs, blkoffs, ulen, copysize);
}
else
{
