From: Djalal Harouni Subject: Re: [PATCH] fs/ext{3,4}: fix potential race when setversion ioctl updates inode Date: Thu, 5 Jan 2012 01:40:09 +0100 Message-ID: <20120105003751.GA4010@dztty> References: <20120103013152.GA26455@dztty> <20120104174609.GD28907@quack.suse.cz> <6C16105A-D0EE-413E-B993-F223CFC75307@dilger.ca> <20120104233254.GH28907@quack.suse.cz> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Andreas Dilger , Andrew Morton , "Darrick J. Wong" , Theodore Ts'o , Yongqiang Yang , ext4 development , linux-kernel Mailing List , Al Viro To: Jan Kara Return-path: Received: from numidia.opendz.org ([98.142.220.152]:34554 "EHLO numidia.opendz.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757296Ab2AEAhG (ORCPT ); Wed, 4 Jan 2012 19:37:06 -0500 Content-Disposition: inline In-Reply-To: <20120104233254.GH28907@quack.suse.cz> Sender: linux-ext4-owner@vger.kernel.org List-ID: On Thu, Jan 05, 2012 at 12:32:54AM +0100, Jan Kara wrote: > On Wed 04-01-12 16:15:04, Andreas Dilger wrote: > > On 2012-01-04, at 10:46 AM, Jan Kara wrote: > > > On Tue 03-01-12 02:31:52, Djalal Harouni wrote: > > >> > > >> The EXT{3,4}_IOC_SETVERSION ioctl() updates the inode without i_mutex, > > >> this can lead to a race with the other operations that update the same > > >> inode. > > >> > > >> Patch tested. > > > > > > OK, so I've taken the patch into my tree, just updated the changelog > > > which result of our discussion in this thread. I also took the ext4 part > > > since there is no risk of conflict and the patch looks obvious. > > > > Actually, I'd like to hear more about whether this is a real problem, or > > if it is just a theoretical problem found during code inspection or from > > some static code analysis tool? > As far as I understood that was just a theoretical issue and I applied > the patch just on the grounds that it is more consistent to use i_mutex for > i_generation changes. This was found using a static code analysis tool (currently a PoC) which is a part of a research project at our university. And later, code inspection confirms that i_ctime updates can be disturbed. I should have specified this. Sorry. > > With the metadata checksum feature we were discussing using the inode > > generation as part of the seed for the directory leaf block checksum, so > > that it wasn't possible to incorrectly access stale directory blocks from > > a previous incarnation of the same inode number. > > > > We were discussing just disabling this ioctl on filesystems with metadata > > checksums, and printing a deprecation warning for filesystems without that > > feature enabled. I'm not aware of any real-world use for this ioctl, since > > NFS cannot use it to reconstruct handles because there's no API to allocate > > an inode with a specific number, so setting the generation is pointless. > OK, I didn't know this. I'm fine with deprecating the ioctl if it's > useless but since that's going to take a while I think the cleanup still > makes some sense. Actually I've grepped this ioctl but did not found use cases, but as ext{3,2} also support it, I did not say anything (this is old, there is even the EXT4_IOC_SETVERSION_OLD ioctl ?). I don't know if this ioctl is used or not. Only the reiserfs and ext{2,3,4} filesystems support this ioctl. The reiserfs do not use mutexes at all, even in the REISERFS_IOC_SETFLAGS ioctl which will test and set _all_ the possible values of the i_flags field. Perhaps I should also send a patch for this ? And perhaps ext2 should also be updated. > Honza > -- > Jan Kara > SUSE Labs, CR Thanks for the feedback. -- tixxdz http://opendz.org