linux-kernel - sr driver fails to update inode size after media change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20110323104911.GA18422@stefanha-thinkpad.localdomain>
Date:	Wed, 23 Mar 2011 10:49:11 +0000
From:	Stefan Hajnoczi <stefanha@...ux.vnet.ibm.com>
To:	Jens Axboe <axboe@...nel.dk>,
	"James E.J. Bottomley" <James.Bottomley@...e.de>,
	Amit Shah <amit.shah@...hat.com>,
	Kay Sievers <kay.sievers@...y.org>, linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: sr driver fails to update inode size after media change

Hi,
Both 2.6.38 and older kernels do not update the CD-ROM block device
inode's size after media change.  If one process holds a file descriptor
to the device across media change, then all other processes on the
system will read the outdated size when they use lseek(2) even if they
opened the device after media change.

The reason for this is that although the sysfs size attribute is
up-to-date, the inode size is never updated by the sr driver or the
universal cdrom driver.

Here is an example.  There is a medium inserted:
$ cat /sys/block/sr0/size
7656192

Now let's start a process that keeps the file descriptor open:
$ python
1>>> import os
1>>> fd = os.open('/dev/sr0', os.O_RDONLY | os.O_NONBLOCK)
1>>> os.lseek(fd, 0, 2) / 512
7656192

Now change the medium and check what sysfs says after hald/udisks has
polled:
$ cat /sys/block/sr0/size
15120512

Okay, the size has been updated in sysfs.  The python process still has
a file descriptor to the device open.  Let's start a new process and see
what lseek(2) says:
$ python
2>>> import os
2>>> fd = os.open('/dev/sr0', os.O_RDONLY | os.O_NONBLOCK)
2>>> os.lseek(fd, 0, 2) / 512
7656192
2>>> os.close(fd)

Still the old value because the inode size has not been updated.

Close the file descriptor in the original process so there are no more
references and then reopen it:
1>>> os.close(fd)
1>>> fd = os.open('/dev/sr0', os.O_RDONLY | os.O_NONBLOCK)
1>>> os.lseek(fd, 0, 2) / 512
15120512

Now we get the new value.

I would like to add a check_disk_size_change() call to sr.c.  Is there a
reason to keep the existing behavior?

Stefan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/