linux-ext4 - Re: [PATCH] ext4: reject mount options not supported when remounting in handle_mount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200416052352.GK2309605@iweiny-DESK2.sc.intel.com>
Date:   Wed, 15 Apr 2020 22:23:52 -0700
From:   Ira Weiny <ira.weiny@...el.com>
To:     "Theodore Y. Ts'o" <tytso@....edu>
Cc:     Ext4 Developers List <linux-ext4@...r.kernel.org>,
        syzkaller-bugs@...glegroups.com, stable@...nel.org,
        syzbot+bca9799bf129256190da@...kaller.appspotmail.com
Subject: Re: [PATCH] ext4: reject mount options not supported when remounting
 in handle_mount_opt()

On Wed, Apr 15, 2020 at 06:07:52PM -0400, Theodore Y. Ts'o wrote:
> On Wed, Apr 15, 2020 at 01:25:37PM -0700, Ira Weiny wrote:
> > This fundamentally changes the behavior from forcing the dax mode to be the
> > same across the remount to only failing if we are going from non-dax to dax,
> > adding -o dax on the remount?
> > 
> > But going from -o dax to 'not -o dax' would be ok?
> > 
> > FWIW after thinking about it some I _think_ it would be ok to allow the dax
> > mode to change on a remount and let the inodes in memory stay in the mode they
> > are at.  And newly loaded inodes would get the new mode...  Unfortunately
> > without the STATX patch I have proposed the user does not have any way of
> > knowing which files are in which mode.
> 
> We don't currently support mount -o nodax.

But we do support not supplying the option which means 'nodax' right?

> So the intention of the
> current code is that the dax mode can't change in either direction
> (enabling or disabling) as a remount option.
> 
> The syzkaller report was because changing dax mode racing with other
> operations given the current code base, could result in a kernel OOPS.
> So we *do* need to rule it out at least for now.

But does this new patch prevent a dax change from '-o dax' to not specifying
the option?  I admit this option parsing code is confusing me.  So I might be
missing it completely.

> 
> I certainly don't object to allowing changing dax mode as a remount
> --- so long as we have tests to make sure that if we stress opening,
> reading, writing, mmap'ing files, etc., while another thread is
> flipping back and forth between dax=never and dax=always is mount -o
> remount --- and make sure that we don't end up crashing.
> 
> And this test needs to be in xfstests, because trying to figure out
> what triggers a syzkaller failures in file system land is a pain in
> the *ss so we really want a dedicated xfstests for this case.

Agreed.

> Have
> you tested your patch series to make sure we don't have some potential
> races here?

No,  I've not anticipated the potential of this until today...  :-D

Ira