| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 12 Jul 2022 08:32:44 -0700
From: "Darrick J. Wong" <djwong@...nel.org>
To: Jeremy Bongio <bongiojp@...il.com>
Cc: Ted Tso <tytso@....edu>, linux-ext4@...r.kernel.org,
linux-api@...r.kernel.org, linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH v2] Add ioctls to get/set the ext4 superblock uuid.
On Mon, Jul 11, 2022 at 09:33:00PM -0700, Jeremy Bongio wrote:
> On Tue, Jul 5, 2022 at 10:07 AM Darrick J. Wong <djwong@...nel.org> wrote:
> >
> > On Fri, Jul 01, 2022 at 01:11:23PM -0700, Jeremy Bongio wrote:
> > > This fixes a race between changing the ext4 superblock uuid and operations
> > > like mounting, resizing, changing features, etc.
> > >
> > > Reviewed-by: Theodore Ts'o <tytso@....edu>
> > > Signed-off-by: Jeremy Bongio <bongiojp@...il.com>
> > > ---
> > > fs/ext4/ext4.h | 13 ++++++++
> > > fs/ext4/ioctl.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++++
> > > 2 files changed, 96 insertions(+)
> > >
> > > diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
> > > index 75b8d81b2469..0cf960cb591e 100644
> > > --- a/fs/ext4/ext4.h
> > > +++ b/fs/ext4/ext4.h
> > > @@ -724,6 +724,8 @@ enum {
> > > #define EXT4_IOC_GETSTATE _IOW('f', 41, __u32)
> > > #define EXT4_IOC_GET_ES_CACHE _IOWR('f', 42, struct fiemap)
> > > #define EXT4_IOC_CHECKPOINT _IOW('f', 43, __u32)
> > > +#define EXT4_IOC_GETFSUUID _IOR('f', 44, struct fsuuid)
> > > +#define EXT4_IOC_SETFSUUID _IOW('f', 44, struct fsuuid)
> > >
> > > #define EXT4_IOC_SHUTDOWN _IOR ('X', 125, __u32)
> > >
> > > @@ -753,6 +755,17 @@ enum {
> > > EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT | \
> > > EXT4_IOC_CHECKPOINT_FLAG_DRY_RUN)
> > >
> > > +/*
> > > + * Structure for EXT4_IOC_GETFSUUID/EXT4_IOC_SETFSUUID
> > > + */
> > > +struct fsuuid {
> > > + __u32 fu_len;
> > > + __u32 fu_flags;
> > > + __u8 __user fu_uuid[];
> >
> > __user is unnecessary here -- it applies to pointers, not to struct
> > members.
> >
> > > +};
> > > +
> > > +#define EXT4_IOC_SETFSUUID_FLAG_BLOCKING 0x1
> >
> > What does this do?
> >
> > (Better yet, can you please write a manpage describing these new
> > ioctls?)
>
> Good idea. I'll write a manpage as if it were being converted to a general ioctl
> and not specific to ext4.
Thank you. :)
> >
> > > +
> > > #if defined(__KERNEL__) && defined(CONFIG_COMPAT)
> > > /*
> > > * ioctl commands in 32 bit emulation
> > > diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
> > > index cb01c1da0f9d..75069afc16ae 100644
> > > --- a/fs/ext4/ioctl.c
> > > +++ b/fs/ext4/ioctl.c
> > > @@ -20,6 +20,7 @@
> > > #include <linux/delay.h>
> > > #include <linux/iversion.h>
> > > #include <linux/fileattr.h>
> > > +#include <linux/uuid.h>
> > > #include "ext4_jbd2.h"
> > > #include "ext4.h"
> > > #include <linux/fsmap.h>
> > > @@ -41,6 +42,15 @@ static void ext4_sb_setlabel(struct ext4_super_block *es, const void *arg)
> > > memcpy(es->s_volume_name, (char *)arg, EXT4_LABEL_MAX);
> > > }
> > >
> > > +/*
> > > + * Superblock modification callback function for changing file system
> > > + * UUID.
> > > + */
> > > +static void ext4_sb_setuuid(struct ext4_super_block *es, const void *arg)
> > > +{
> > > + memcpy(es->s_uuid, (__u8 *)arg, UUID_SIZE);
> > > +}
> > > +
> > > static
> > > int ext4_update_primary_sb(struct super_block *sb, handle_t *handle,
> > > ext4_update_sb_callback func,
> > > @@ -1131,6 +1141,73 @@ static int ext4_ioctl_getlabel(struct ext4_sb_info *sbi, char __user *user_label
> > > return 0;
> > > }
> > >
> > > +static int ext4_ioctl_getuuid(struct ext4_sb_info *sbi,
> > > + struct fsuuid __user *ufsuuid)
> > > +{
> > > + int ret = 0;
> > > + __u8 uuid[UUID_SIZE];
> >
> > Save some stack space and copy sbi->s_es->s_uuid into fsuuid.fu_uuid,
> > and then copy_to_user from the kernel stack object out to userspace's
> > object.
>
> I can't copy sbi->s_es->s_uuid into fsuuid.fu_uuid since fu_uuid is a
> VLA (size 0 array).
> Are you suggesting I copy_to_user() from sbi->s_es->s_uuid into
> ufsuuid within the locked region?
No, I'd ... forgotten my own previous suggestion, so please ignore this.
> >
> > > + struct fsuuid fsuuid;
> > > +
> > > + if (copy_from_user(&fsuuid, ufsuuid, sizeof(fsuuid)))
> > > + return -EFAULT;
> > > +
> > > + if (fsuuid.fu_len != UUID_SIZE)
> > > + return -EINVAL;
> >
> > This function needs to check that fsuuid.fu_flags doesn't contain any
> > unknown bitflags.
> >
> > > +
> > > + lock_buffer(sbi->s_sbh);
> > > + memcpy(uuid, sbi->s_es->s_uuid, UUID_SIZE);
> > > + unlock_buffer(sbi->s_sbh);
> > > +
> > > + if (copy_to_user(&ufsuuid->fu_uuid[0], uuid, UUID_SIZE))
> > > + ret = -EFAULT;
> > > + return ret;
> >
> > if (copy_to_user(...))
> > return -EFAULT;
> >
> > return 0;
> >
> > ?
> >
> > > +}
> > > +
> > > +static int ext4_ioctl_setuuid(struct file *filp,
> > > + const struct fsuuid __user *ufsuuid)
> > > +{
> > > + int ret = 0;
> > > + struct super_block *sb = file_inode(filp)->i_sb;
> > > + struct fsuuid fsuuid;
> > > + __u8 uuid[UUID_SIZE];
> > > +
> > > + if (!capable(CAP_SYS_ADMIN))
> > > + return -EPERM;
> > > +
> > > + /*
> > > + * If any checksums (group descriptors or metadata) are being used
> > > + * then the checksum seed feature is required to change the UUID.
> > > + */
> > > + if (((ext4_has_feature_gdt_csum(sb) || ext4_has_metadata_csum(sb))
> > > + && !ext4_has_feature_csum_seed(sb))
> > > + || ext4_has_feature_stable_inodes(sb))
> > > + return -EOPNOTSUPP;
> > > +
> > > + if (copy_from_user(&fsuuid, ufsuuid, sizeof(fsuuid)))
> > > + return -EFAULT;
> > > +
> > > + if (fsuuid.fu_len != UUID_SIZE)
> > > + return -EINVAL;
> >
> > This function needs to check that fsuuid.fu_flags doesn't contain any
> > unknown bits.
> >
> > > +
> > > + if (copy_from_user(uuid, &ufsuuid->fu_uuid[0], UUID_SIZE))
> > > + return -EFAULT;
> > > +
> > > + ret = mnt_want_write_file(filp);
> > > + if (ret)
> > > + return ret;
> > > +
> > > + do {
> > > + if (ret == -EBUSY)
> > > + msleep(1000);
> > > + ret = ext4_update_superblocks_fn(sb, ext4_sb_setuuid, &uuid);
> > > + } while (ret == -EBUSY &&
> > > + fsuuid.fu_flags & EXT4_IOC_SETFSUUID_FLAG_BLOCKING);
> >
> > So... I guess by default, userspace gets NOWAIT mode? That's a little
> > strange, usually kernel convention is blocking mode by default, with
> > nowait selectable via function flags.
> >
> > Also, what's the intended use case here? Why would we want to set a
> > uuid but only if the superblock(s) aren't busy?
>
> When an ext4 filesystem is being resized, which could potentially take
> a long time,
> ext4_update_superblocks_fn() will return -EBUSY. In that case we can
> either sleep and retry,
> or return EBUSY to userspace. However, for my use case, I only care
> about the blocking case.
> I'll remove the flag since the default mode will be blocking.
<nod>
--D
>
> >
> > --D
> >
> > > +
> > > + mnt_drop_write_file(filp);
> > > +
> > > + return ret;
> > > +}
> > > +
> > > static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
> > > {
> > > struct inode *inode = file_inode(filp);
> > > @@ -1509,6 +1586,10 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
> > > return ext4_ioctl_setlabel(filp,
> > > (const void __user *)arg);
> > >
> > > + case EXT4_IOC_GETFSUUID:
> > > + return ext4_ioctl_getuuid(EXT4_SB(sb), (void __user *)arg);
> > > + case EXT4_IOC_SETFSUUID:
> > > + return ext4_ioctl_setuuid(filp, (const void __user *)arg);
> > > default:
> > > return -ENOTTY;
> > > }
> > > @@ -1586,6 +1667,8 @@ long ext4_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
> > > case EXT4_IOC_CHECKPOINT:
> > > case FS_IOC_GETFSLABEL:
> > > case FS_IOC_SETFSLABEL:
> > > + case EXT4_IOC_GETFSUUID:
> > > + case EXT4_IOC_SETFSUUID:
> > > break;
> > > default:
> > > return -ENOIOCTLCMD;
> > > --
> > > 2.37.0.rc0.161.g10f37bed90-goog
> > >
Powered by blists - more mailing lists