linux-kernel - Re: Apparent backward time travel in timestamps on file creation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 30 Mar 2017 11:49:09 -0700
From:   John Stultz <john.stultz@...aro.org>
To:     David Howells <dhowells@...hat.com>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        lkml <linux-kernel@...r.kernel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>
Subject: Re: Apparent backward time travel in timestamps on file creation

On Thu, Mar 30, 2017 at 10:30 AM, David Howells <dhowells@...hat.com> wrote:
> Hi Thomas, John,
>
> I've been writing a testcase for xfstests to test statx.  However, it's turned
> up what I think is a bug in the kernel's time-tracking system.  If I do:
>
>         date +%s.%N
>         touch foo
>         dump-timestamps foo
>
> such that foo is created, sometimes the atime, mtime and ctime timestamps on
> foo will be *before* the time printed by 'date'.
>
> For example:
>
>         [root@...romeda ~]# Z=/b/zebra6; date +%s.%N; touch $Z; /tmp/dump-timestamps $Z
>         1490894656.267225764
>         st_atime: 1490894656.267032686
>         st_mtime: 1490894656.267032686
>         st_ctime: 1490894656.267032686
>
> As can be seen, the three file timestamps are -193078 nsec from the prior
> clock time.  This was with git commit:

Linus covered this already, as its a granularity difference, but it is
something that seems to crop up every few years.

If you want a timestamp that matches the granularity of what the
filesystem uses, you can use clock_gettime(CLOCK_REALTIME_COARSE,..),
which returns the same "time-at-the-last-tick" that filesystem
timestamps use (with the same performance benefit).

Though one slight correction to Linus' comment is that both filesystem
timestamps and CLOCK_REALTIME_COARSE are NTP corrected, the main
performance gain is that one doesn't have go out and read the
clocksource and covert the cycles to nanoseconds.

thanks
-john