linux-kernel - getdents64 lost direntries with SMB/NFS and buffer size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191120001522.GA25139@brightrain.aerifal.cx>
Date:   Tue, 19 Nov 2019 19:15:22 -0500
From:   Rich Felker <dalias@...c.org>
To:     linux-fsdevel@...r.kernel.org
Cc:     musl@...ts.openwall.com, linux-kernel@...r.kernel.org,
        linux-nfs@...r.kernel.org, linux-cifs@...r.kernel.org
Subject: getdents64 lost direntries with SMB/NFS and buffer size < unknown
 threshold

An issue was reported today on the Alpine Linux tracker at
https://gitlab.alpinelinux.org/alpine/aports/issues/10960 regarding
readdir results from SMB/NFS shares with musl libc.

After a good deal of analysis, we determined the root cause to be that
the second and subsequent calls to getdents64 are dropping/skipping
direntries (that have not yet been deleted) when some entries were
deleted following the previous call. The issue appears to happen only
when the buffer size passed to getdents64 is below some threshold
greater than 2k (the size musl uses) but less than 32k (the size glibc
uses, with which we were unable to reproduce the issue).

My guess at the mechanism of failure is that the kernel has cached
some entries which it obtained from the FS server based on whatever
its preferred transfer size is, but didn't yet pass them to userspace
due to limited buffer space, and then purged the buffer when resuming
getdents64 after some entries were deleted for reasons related to the
changes made way back in 0c0308066ca5 (NFS: Fix spurious readdir
cookie loop messages). If so, any such purge likely needs to be
delayed until already-buffered results are read, and there may be
related buggy interactions with seeking that need to be examined.

The to/cc for this message are just my best guesses. Please cc anyone
I missed who should be included when replying, and keep me on cc since
I'm not subscribed to any of these lists but the musl one.

Rich