This patch corrects some erroneous dentry handling in eCryptfs.
If there is a problem creating the lower file, then there is nothing
that the persistent lower file can do to really help us. This patch
makes a vfs_create() failure in the lower filesystem always lead to an
unconditional do_create failure in eCryptfs.
Under certain sequences of operations, the eCryptfs dentry can remain
in the dcache after an unlink. This patch calls d_drop() on the
eCryptfs dentry to correct this.
eCryptfs has no business calling d_delete() directly on a lower
filesystem's dentry. This patch removes the call to d_delete() on the
lower persistent file's dentry in ecryptfs_destroy_inode().
(Thanks to David Kleikamp, Eric Sandeen, and Jeff Moyer for helping
identify and resolve this issue)
Signed-off-by: Michael Halcrow <[email protected]>
---
fs/ecryptfs/inode.c | 20 ++++----------------
fs/ecryptfs/super.c | 1 -
2 files changed, 4 insertions(+), 17 deletions(-)
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 0b1ab01..5a71918 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -120,22 +120,9 @@ ecryptfs_do_create(struct inode *directory_inode,
rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode,
ecryptfs_dentry, mode, nd);
if (rc) {
- struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode;
- struct ecryptfs_inode_info *inode_info =
- ecryptfs_inode_to_private(ecryptfs_inode);
-
- printk(KERN_WARNING "%s: Error creating underlying file; "
- "rc = [%d]; checking for existing\n", __FUNCTION__, rc);
- if (inode_info) {
- mutex_lock(&inode_info->lower_file_mutex);
- if (!inode_info->lower_file) {
- mutex_unlock(&inode_info->lower_file_mutex);
- printk(KERN_ERR "%s: Failure to set underlying "
- "file; rc = [%d]\n", __FUNCTION__, rc);
- goto out_lock;
- }
- mutex_unlock(&inode_info->lower_file_mutex);
- }
+ printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
+ "rc = [%d]\n", __FUNCTION__, rc);
+ goto out_lock;
}
rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
directory_inode->i_sb, 0);
@@ -451,6 +438,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
dentry->d_inode->i_nlink =
ecryptfs_inode_to_lower(dentry->d_inode)->i_nlink;
dentry->d_inode->i_ctime = dir->i_ctime;
+ d_drop(dentry);
out_unlock:
unlock_parent(lower_dentry);
return rc;
diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c
index f8cdab2..4859c4e 100644
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -86,7 +86,6 @@ static void ecryptfs_destroy_inode(struct inode *inode)
fput(inode_info->lower_file);
inode_info->lower_file = NULL;
d_drop(lower_dentry);
- d_delete(lower_dentry);
}
}
mutex_unlock(&inode_info->lower_file_mutex);
--
1.5.3.6
On Mon, 7 Jan 2008 23:25:42 -0600 Michael Halcrow <[email protected]> wrote:
> --- a/fs/ecryptfs/inode.c
> +++ b/fs/ecryptfs/inode.c
> @@ -120,22 +120,9 @@ ecryptfs_do_create(struct inode *directory_inode,
> rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode,
> ecryptfs_dentry, mode, nd);
> if (rc) {
> - struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode;
> - struct ecryptfs_inode_info *inode_info =
> - ecryptfs_inode_to_private(ecryptfs_inode);
> -
> - printk(KERN_WARNING "%s: Error creating underlying file; "
> - "rc = [%d]; checking for existing\n", __FUNCTION__, rc);
> - if (inode_info) {
> - mutex_lock(&inode_info->lower_file_mutex);
> - if (!inode_info->lower_file) {
> - mutex_unlock(&inode_info->lower_file_mutex);
> - printk(KERN_ERR "%s: Failure to set underlying "
> - "file; rc = [%d]\n", __FUNCTION__, rc);
> - goto out_lock;
> - }
> - mutex_unlock(&inode_info->lower_file_mutex);
> - }
> + printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
> + "rc = [%d]\n", __FUNCTION__, rc);
> + goto out_lock;
> }
> rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
> directory_inode->i_sb, 0);
Will this cause an undesirable log storm if the underlying fs runs out of
space?
On Mon, Jan 07, 2008 at 09:45:17PM -0800, Andrew Morton wrote:
> On Mon, 7 Jan 2008 23:25:42 -0600 Michael Halcrow <[email protected]> wrote:
>
> > --- a/fs/ecryptfs/inode.c
> > +++ b/fs/ecryptfs/inode.c
> > @@ -120,22 +120,9 @@ ecryptfs_do_create(struct inode *directory_inode,
> > rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode,
> > ecryptfs_dentry, mode, nd);
> > if (rc) {
> > - struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode;
> > - struct ecryptfs_inode_info *inode_info =
> > - ecryptfs_inode_to_private(ecryptfs_inode);
> > -
> > - printk(KERN_WARNING "%s: Error creating underlying file; "
> > - "rc = [%d]; checking for existing\n", __FUNCTION__, rc);
> > - if (inode_info) {
> > - mutex_lock(&inode_info->lower_file_mutex);
> > - if (!inode_info->lower_file) {
> > - mutex_unlock(&inode_info->lower_file_mutex);
> > - printk(KERN_ERR "%s: Failure to set underlying "
> > - "file; rc = [%d]\n", __FUNCTION__, rc);
> > - goto out_lock;
> > - }
> > - mutex_unlock(&inode_info->lower_file_mutex);
> > - }
> > + printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
> > + "rc = [%d]\n", __FUNCTION__, rc);
> > + goto out_lock;
> > }
> > rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
> > directory_inode->i_sb, 0);
>
> Will this cause an undesirable log storm if the underlying fs runs
> out of space?
When you're bumping up against the end of your storage space, you will
get a lot more that just this message in your logs. There are printk's
in ecryptfs_write_lower(), ecryptfs_encrypt_page(), ecryptfs_write(),
and ecryptfs_write_metadata_to_contents() that will get pretty
noisy. Is it worth wrapping those in a higher level of verbosity?
Mike
On Tue, 8 Jan 2008 15:58:07 -0600
Michael Halcrow <[email protected]> wrote:
> > > rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
> > > directory_inode->i_sb, 0);
> >
> > Will this cause an undesirable log storm if the underlying fs runs
> > out of space?
>
> When you're bumping up against the end of your storage space, you will
> get a lot more that just this message in your logs. There are printk's
> in ecryptfs_write_lower(), ecryptfs_encrypt_page(), ecryptfs_write(),
> and ecryptfs_write_metadata_to_contents() that will get pretty
> noisy. Is it worth wrapping those in a higher level of verbosity?
The consequences of this can actually be pretty harmful. syslogd typically
does sychronous writes so a random full disk can cause a seek storm over on
the log disk and a runaway ecryptfs-using application could pretty quickly
exhaust the space on the log disk.
So I'd suggest that sometime you go through the fs and find any such
user-triggerable printks and fix them up. The most robust way of fixing
them up would be to delete them, or make them dependent on
CONFIG_ECRYPTFS_DEBUG. Fiddling with the facility levels would help, but
it just lessens the probability rather than fixing it completely.