linux-kernel - Re: fscache corruption in Linux 5.17?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yl7d++G25sNXIR+p@rabbit.intern.cm-ag>
Date:   Tue, 19 Apr 2022 18:06:19 +0200
From:   Max Kellermann <mk@...all.com>
To:     David Howells <dhowells@...hat.com>
Cc:     Max Kellermann <mk@...all.com>, linux-cachefs@...hat.com,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: fscache corruption in Linux 5.17?

On 2022/04/19 17:56, David Howells <dhowells@...hat.com> wrote:
> This is weird.  It looks like content got slid down by 31 bytes and 31 zero
> bytes got added at the end.  I'm not sure how fscache would achieve that -
> nfs's implementation should only be dealing with pages.

Did you read this part of my email?:

On 2022/04/12 17:10, Max Kellermann <max@...bit.intern.cm-ag> wrote:
> The corruption can be explained by WordPress commit
> https://github.com/WordPress/WordPress/commit/07855db0ee8d5cff2 which
> makes the file 31 bytes longer (185055 -> 185086).  The "broken" web
> server sees the new contents until offset 184320 (= 45 * 4096), but
> sees the old contents from there on; followed by 31 null bytes
> (because the kernel reads past the end of the cache?).

My theory was that fscache shows a mix of old and new pages after the
file was modified.  Does this make sense?

Is there anything I can do to give you data from this server's cache?