linux-kernel - tmpfs inode leakage when opening file with O_TMP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHMF36F4JN44Y-yMnxw36A8cO0yVUQhAkvJDcj_gbWbsuUAA5A@mail.gmail.com>
Date:   Mon, 11 Feb 2019 15:18:11 +0100
From:   Matej Kupljen <matej.kupljen@...il.com>
To:     linux-kernel@...r.kernel.org
Subject: tmpfs inode leakage when opening file with O_TMP_FILE

Hi,

it seems that when opening file on file system that is mounted on
tmpfs with the O_TMPFILE flag and using linkat call after that, it
uses 2 inodes instead of 1.

This is simple test case:

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <linux/limits.h>
#include <errno.h>

#define TEST_STRING     "Testing\n"

#define TMP_PATH        "/tmp/ping/"
#define TMP_FILE        "file.txt"

int main(int argc, char* argv[])
{
        char path[PATH_MAX];
        int fd;
        int rc;

        fd = open(TMP_PATH, __O_TMPFILE | O_RDWR,
                        S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP |
S_IROTH | S_IWOTH);

        rc = write(fd, TEST_STRING, strlen(TEST_STRING));

        snprintf(path, PATH_MAX,  "/proc/self/fd/%d", fd);
        linkat(AT_FDCWD, path, AT_FDCWD, TMP_PATH TMP_FILE, AT_SYMLINK_FOLLOW);
        close(fd);

        return 0;
}

I have checked indoes with "df -i" tool. The first inode is used when
the call to open is executed and the second one when the call to
linkat is executed.
It is not decreased when close is executed.

I have also tested this on an ext4 mounted fs and there only one inode is used.

I tested this on:
$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.1 LTS"

$ uname -a
Linux Orion 4.15.0-43-generic #46-Ubuntu SMP Thu Dec 6 14:45:28 UTC
2018 x86_64 x86_64 x86_64 GNU/Linux

If you need any more information, please let me know.

And please CC me when replying, I am not subscribed to the list.

Thanks and BR,
Matej