linux-kernel - Apparent backward time travel in timestamps on file creation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 30 Mar 2017 18:30:07 +0100
From:   David Howells <dhowells@...hat.com>
To:     tglx@...utronix.de, john.stultz@...aro.org
cc:     dhowells@...hat.com, torvalds@...ux-foundation.org,
        linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org
Subject: Apparent backward time travel in timestamps on file creation

Hi Thomas, John,

I've been writing a testcase for xfstests to test statx.  However, it's turned
up what I think is a bug in the kernel's time-tracking system.  If I do:

	date +%s.%N
	touch foo
	dump-timestamps foo

such that foo is created, sometimes the atime, mtime and ctime timestamps on
foo will be *before* the time printed by 'date'.

For example:

	[root@...romeda ~]# Z=/b/zebra6; date +%s.%N; touch $Z; /tmp/dump-timestamps $Z
	1490894656.267225764
	st_atime: 1490894656.267032686
	st_mtime: 1490894656.267032686
	st_ctime: 1490894656.267032686

As can be seen, the three file timestamps are -193078 nsec from the prior
clock time.  This was with git commit:

	89970a04d70c6c9e5e4492fd4096c0b5630a478c

the current head of Linus's tree.

I'm sure I've seen a case where tv_sec differed by 1 when running my xfstests
script, but it's hard to reproduce that.  It also occurs with other file
types, not just regular files.  It occurs on both ext4 and xfs.

I've attached the source for dump-timestamps below.

David
---
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
int main(int argc, char *argv[])
{
	struct stat st;

	if (argc != 2) {
		fprintf(stderr, "Format: %s <file>\n", argv[0]);
		exit(2);
	}
	if (stat(argv[1], &st) == -1) {
		perror(argv[1]);
		exit(1);
	}
	printf("st_atime: %ld.%09ld\n", st.st_atim.tv_sec, st.st_atim.tv_nsec);
	printf("st_mtime: %ld.%09ld\n", st.st_mtim.tv_sec, st.st_mtim.tv_nsec);
	printf("st_ctime: %ld.%09ld\n", st.st_ctim.tv_sec, st.st_ctim.tv_nsec);
	return 0;
}