linux-kernel - Re: [PATCH RFC] Ext3 data=guarded

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090917215309.GD10599@shareable.org>
Date:	Thu, 17 Sep 2009 22:53:09 +0100
From:	Jamie Lokier <jamie@...reable.org>
To:	Chris Mason <chris.mason@...cle.com>
Cc:	jack@...e.cz, tytso@....edu, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH RFC] Ext3 data=guarded

Chris Mason wrote:
> The main difference from data=ordered is that data=guarded only updates
> the on disk i_size after all of the data blocks are on disk.  This allows
> us to avoid flushing all the data pages down to disk with every commit.

I'm a bit confused, because I thought that was already guaranteed by
ext3 data=ordered, due to the following mail:

  Date: Thu, 16 Mar 2006 13:09:04 -0500
  Subject: Re: ext3_ordered_writepage() questions
  From: Theodore Ts'o <tytso@....edu>

  > >Yup.  Ordered-mode JBD commit needs to write and wait upon all dirty
  > >file-data buffers prior to journalling the metadata.  If we didn't run
  > >journal_dirty_data_fn() against those buffers then they'd still be under
  > >I/O after commit had completed.
  > >
  > In  non-block allocation case, what metadata are we journaling in
  > writepage() ?
  > block allocation happend in prepare_write() and commit_write()
  > journaled the transaction. All the meta data updates should be done
  > there.  What JBD commit are you refering to here ?

  Basically, this boils down to what is our definition of ordered-mode?

  If the goal is to make sure we avoid the security exposure of
  allocating a block and then crashing before we write the data block,
  potentially exposing previously written data that might be belong to
  another user, then what Badari is suggesting would avoid this
  particular problem.

  However, if what we are doing is overwriting our own data with more an
  updated, more recent version of the data block, do we guarantee that
  any ordering semantics apply?  For example, what if we write a data
  block, and then follow it up with some kind of metadata update (say we
  touch atime, or add an extended attribute).  Do we guarantee that if
  the metadata update is committed, that the data block will have made
  it to disk as well?  Today that is the way things work, but is that
  guarantee part of the contract of ordered-mode?

						  - Ted

-- Jamie
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/