linux-ext4 - Re: [PATCH] fs: i_version mntopt gets visible through /proc/mounts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200618223948.GI2005@dread.disaster.area>
Date:   Fri, 19 Jun 2020 08:39:48 +1000
From:   Dave Chinner <david@...morbit.com>
To:     Masayoshi Mizuma <msys.mizuma@...il.com>
Cc:     "J. Bruce Fields" <bfields@...ldses.org>,
        Eric Sandeen <sandeen@...deen.net>,
        "Darrick J. Wong" <darrick.wong@...cle.com>,
        Christoph Hellwig <hch@...radead.org>,
        Theodore Ts'o <tytso@....edu>,
        Andreas Dilger <adilger.kernel@...ger.ca>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Masayoshi Mizuma <m.mizuma@...fujitsu.com>,
        linux-ext4@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-xfs <linux-xfs@...r.kernel.org>
Subject: Re: [PATCH] fs: i_version mntopt gets visible through /proc/mounts

On Wed, Jun 17, 2020 at 11:45:35PM -0400, Masayoshi Mizuma wrote:
> On Thu, Jun 18, 2020 at 01:05:39PM +1000, Dave Chinner wrote:
> > On Wed, Jun 17, 2020 at 09:30:26PM -0400, Masayoshi Mizuma wrote:
> > > On Wed, Jun 17, 2020 at 02:45:07PM -0400, J. Bruce Fields wrote:
> > > > On Wed, Jun 17, 2020 at 01:28:11PM -0500, Eric Sandeen wrote:
> > > > > but mount(8) has already exposed this interface:
> > > > > 
> > > > >        iversion
> > > > >               Every time the inode is modified, the i_version field will be incremented.
> > > > > 
> > > > >        noiversion
> > > > >               Do not increment the i_version inode field.
> > > > > 
> > > > > so now what?
> > > > 
> > > > It's not like anyone's actually depending on i_version *not* being
> > > > incremented.  (Can you even observe it from userspace other than over
> > > > NFS?)
> > > > 
> > > > So, just silently turn on the "iversion" behavior and ignore noiversion,
> > > > and I doubt you're going to break any real application.
> > > 
> > > I suppose it's probably good to remain the options for user compatibility,
> > > however, it seems that iversion and noiversiont are useful for
> > > only ext4.
> > > How about moving iversion and noiversion description on mount(8)
> > > to ext4 specific option?
> > > 
> > > And fixing the remount issue for XFS (maybe btrfs has the same
> > > issue as well)?
> > > For XFS like as:
> > > 
> > > diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
> > > index 379cbff438bc..2ddd634cfb0b 100644
> > > --- a/fs/xfs/xfs_super.c
> > > +++ b/fs/xfs/xfs_super.c
> > > @@ -1748,6 +1748,9 @@ xfs_fc_reconfigure(
> > >                         return error;
> > >         }
> > > 
> > > +       if (XFS_SB_VERSION_NUM(&mp->m_sb) == XFS_SB_VERSION_5)
> > > +               mp->m_super->s_flags |= SB_I_VERSION;
> > > +
> > >         return 0;
> > >  }
> > 
> > no this doesn't work, because the sueprblock flags are modified
> > after ->reconfigure is called.
> > 
> > i.e. reconfigure_super() does this:
> > 
> > 	if (fc->ops->reconfigure) {
> > 		retval = fc->ops->reconfigure(fc);
> > 		if (retval) {
> > 			if (!force)
> > 				goto cancel_readonly;
> > 			/* If forced remount, go ahead despite any errors */
> > 			WARN(1, "forced remount of a %s fs returned %i\n",
> > 			     sb->s_type->name, retval);
> > 		}
> > 	}
> > 
> > 	WRITE_ONCE(sb->s_flags, ((sb->s_flags & ~fc->sb_flags_mask) |
> > 				 (fc->sb_flags & fc->sb_flags_mask)));
> > 
> > And it's the WRITE_ONCE() line that clears SB_I_VERSION out of
> > sb->s_flags. Hence adding it in ->reconfigure doesn't help.
> > 
> > What we actually want to do here in xfs_fc_reconfigure() is this:
> > 
> > 	if (XFS_SB_VERSION_NUM(&mp->m_sb) == XFS_SB_VERSION_5)
> > 		fc->sb_flags_mask |= SB_I_VERSION;
> > 
> > So that the SB_I_VERSION is not cleared from sb->s_flags.
> > 
> > I'll also note that btrfs will need the same fix, because it also
> > sets SB_I_VERSION unconditionally, as will any other filesystem that
> > does this, too.
> 
> Thank you for pointed it out.
> How about following change? I believe it works both xfs and btrfs...
> 
> diff --git a/fs/super.c b/fs/super.c
> index b0a511bef4a0..42fc6334d384 100644
> --- a/fs/super.c
> +++ b/fs/super.c
> @@ -973,6 +973,9 @@ int reconfigure_super(struct fs_context *fc)
>                 }
>         }
> 
> +       if (sb->s_flags & SB_I_VERSION)
> +               fc->sb_flags |= MS_I_VERSION;
> +
>         WRITE_ONCE(sb->s_flags, ((sb->s_flags & ~fc->sb_flags_mask) |
>                                  (fc->sb_flags & fc->sb_flags_mask)));
>         /* Needs to be ordered wrt mnt_is_readonly() */

This will prevent SB_I_VERSION from being turned off at all. That
will break existing filesystems that allow SB_I_VERSION to be turned
off on remount, such as ext4.

The manipulations here need to be in the filesystem specific code;
we screwed this one up so badly there is no "one size fits all"
behaviour that we can implement in the generic code...

Cheers,

Dave.
-- 
Dave Chinner
david@...morbit.com