linux-ext4 - Re: [PATCH 1/2] fuse2fs: mount norecovery if main block device is readonly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aPKk8N1_ssr3f6Zd@cern.ch>
Date: Fri, 17 Oct 2025 15:20:00 -0500
From: Dave Dykstra <dwd@...n.ch>
To: "Darrick J. Wong" <djwong@...nel.org>
Cc: tytso@....edu, linux-ext4@...r.kernel.org
Subject: Re: [PATCH 1/2] fuse2fs: mount norecovery if main block device is
 readonly

On Fri, Oct 17, 2025 at 12:38:41PM -0700, Darrick J. Wong wrote:
> On Thu, Oct 16, 2025 at 02:34:18PM -0500, Dave Dykstra wrote:
...
> > > +		err_printf(ff, "%s.\n",
> > > +			   _("read-only device, trying to mount norecovery"));
> > > +		flags &= ~EXT2_FLAG_RW;
> > > +		ff->ro = 1;
> > > +		ff->norecovery = 1;
> > 
> > I don't think it's good to switch to read-only+norecovery even when a
> > read-write mode was requested.  That goes too far.
> 
> The block device cannot be opened for write, so the mount cannot allow
> user programs to write to files, and the fs driver cannot recover the
> journal and it cannot write to the disk.  The only other choice would
> be to fail the mount.

Yes, I think it's better to fail the mount if recovery is needed and it
can't be done.

> norecovery is wrong though.  The kernel fails the mount if the journal
> needs recovery, the block device is ro, and the user didn't specify
> norecovery.

That makes more sense.

> > It also doesn't catch when recovery is needed.
> 
> What specifically do you mean "catch when recovery is needed"?  68 lines
> down from the ext2fs_open2 call is a check for the needsrecovery state,
> followed by recovering the journal.

I meant that it should fail in that case because it can't recover.

> > My proposed patch only reopens read-only
> > when ro was requested and then later checks to see if recovery is needed
> > and if so, errors out.
> 
> Your patch also didn't re-check the feature support after reopening the
> block device, which you dismissed even though that can lead to
> catastrophic behavior.

In this version of the patch there is no reopening, there is only a
switch to open without RW if the RW open fails.  So all feature checks
happen after it.

Dave