linux-ext4 - strange ext{3,4}

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080315160731.GA4186@dmon-lap.sw.ru>
Date:	Sat, 15 Mar 2008 19:07:32 +0300
From:	Dmitri Monakhov <dmonakhov@...nvz.org>
To:	linux-ext4@...r.kernel.org
Subject: strange ext{3,4}_settattr logic

Hello.
I've found what ext3_setattr() code has some strange logic. I'm talking
about truncate path. 

int ext3_setattr(struct dentry *dentry, struct iattr *attr)
{
...
	if (S_ISREG(inode->i_mode) &&
            attr->ia_valid & ATTR_SIZE && attr->ia_size < inode->i_size) {
                handle_t *handle;
<<< This is shrinking case, and according to function comments:
<<< "In particular, we want to make sure that when the VFS
<<< * shrinks i_size, we put the inode on the orphan list and modify
<<< * i_disksize immediately"
<<< we about to write i_disksize. But WHY do we have to do it explicitly?
<<< Later inode_setattr() will call ext3_truncate() which will do it
<<< this work for us.
                handle = ext3_journal_start(inode, 3);
                if (IS_ERR(handle)) {
                        error = PTR_ERR(handle);
                        goto err_out;
                }

                error = ext3_orphan_add(handle, inode);
                EXT3_I(inode)->i_disksize = attr->ia_size;
                rc = ext3_mark_inode_dirty(handle, inode);
                if (!error)
                        error = rc;
                ext3_journal_stop(handle);
        }
        rc = inode_setattr(inode, attr);
<<< Now the most interesting question. What we have to do now in 
<<< case of error? We are in tricky situation. Truncate not happened,
<<< and blocks visible to the user, but i_disksize was already written,
<<< so later memory reclaiming/ read_inode will result in unexpected
<<< updating i_size.
        /* If inode_setattr's call to ext3_truncate failed to get a
         * transaction handle at all, we need to clean up the in-core
         * orphan list manually. */
<<< Following code will remove inode only from in memory(because handle = NULL)
<<< orphan list. Please someone explain me what this lines suppose to do
<<< actually.
        if (inode->i_nlink)
                ext3_orphan_del(NULL, inode);
...
}
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html