lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 24 Jun 2019 13:37:37 +0200 From: Jan Kara <jack@...e.cz> To: "Darrick J. Wong" <darrick.wong@...cle.com> Cc: matthew.garrett@...ula.com, yuchao0@...wei.com, tytso@....edu, ard.biesheuvel@...aro.org, josef@...icpanda.com, clm@...com, adilger.kernel@...ger.ca, viro@...iv.linux.org.uk, jack@...e.com, dsterba@...e.com, jaegeuk@...nel.org, jk@...abs.org, reiserfs-devel@...r.kernel.org, linux-efi@...r.kernel.org, devel@...ts.orangefs.org, linux-kernel@...r.kernel.org, linux-f2fs-devel@...ts.sourceforge.net, linux-xfs@...r.kernel.org, linux-mm@...ck.org, linux-nilfs@...r.kernel.org, linux-mtd@...ts.infradead.org, ocfs2-devel@....oracle.com, linux-fsdevel@...r.kernel.org, linux-ext4@...r.kernel.org, linux-btrfs@...r.kernel.org Subject: Re: [PATCH 2/7] vfs: flush and wait for io when setting the immutable flag via SETFLAGS On Fri 21-06-19 16:57:07, Darrick J. Wong wrote: > From: Darrick J. Wong <darrick.wong@...cle.com> > > When we're using FS_IOC_SETFLAGS to set the immutable flag on a file, we > need to ensure that userspace can't continue to write the file after the > file becomes immutable. To make that happen, we have to flush all the > dirty pagecache pages to disk to ensure that we can fail a page fault on > a mmap'd region, wait for pending directio to complete, and hope the > caller locked out any new writes by holding the inode lock. > > Signed-off-by: Darrick J. Wong <darrick.wong@...cle.com> Seeing the way this worked out, is there a reason to have separate vfs_ioc_setflags_flush_data() instead of folding the functionality in vfs_ioc_setflags_check() (possibly renaming it to vfs_ioc_setflags_prepare() to indicate it does already some changes)? I don't see any place that would need these two separated... > +/* > + * Flush all pending IO and dirty mappings before setting S_IMMUTABLE on an > + * inode via FS_IOC_SETFLAGS. If the flush fails we'll clear the flag before > + * returning error. > + * > + * Note: the caller should be holding i_mutex, or else be sure that > + * they have exclusive access to the inode structure. > + */ > +static inline int vfs_ioc_setflags_flush_data(struct inode *inode, int flags) > +{ > + int ret; > + > + if (!vfs_ioc_setflags_need_flush(inode, flags)) > + return 0; > + > + inode_set_flags(inode, S_IMMUTABLE, S_IMMUTABLE); > + ret = inode_flush_data(inode); > + if (ret) > + inode_set_flags(inode, 0, S_IMMUTABLE); > + return ret; > +} Also this sets S_IMMUTABLE whenever vfs_ioc_setflags_need_flush() returns true. That is currently the right thing but seems like a landmine waiting to trip? So I'd just drop the vfs_ioc_setflags_need_flush() abstraction to make it clear what's going on. Honza -- Jan Kara <jack@...e.com> SUSE Labs, CR
Powered by blists - more mailing lists