linux-kernel - Re: fscache corruption in Linux 5.17?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yl75D02pXj71kQBx@rabbit.intern.cm-ag>
Date:   Tue, 19 Apr 2022 20:01:51 +0200
From:   Max Kellermann <mk@...all.com>
To:     David Howells <dhowells@...hat.com>
Cc:     Max Kellermann <mk@...all.com>, linux-cachefs@...hat.com,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: fscache corruption in Linux 5.17?

On 2022/04/19 18:42, David Howells <dhowells@...hat.com> wrote:
> Could the file have been modified by a third party?

According to our support tickets, the customers used WordPress's
built-in updater, which resulted in corrupt PHP sources.

We have configured stickiness in the load balancer; HTTP requests to
one website always go through the same web server.  Which implies that
the same web server that saw the corrupt files was the very same one
that wrote the new file contents.  This part surprises me, because
writing a page to the NFS server should update (or flush/invalidate)
the old cache page.  It would be easy for a *different* NFS client to
miss out on updated file contents, but this is not what happened.

On 2022/04/19 18:47, David Howells <dhowells@...hat.com> wrote:
> Do the NFS servers change the files that are being served - or is it
> just WordPress pushing the changes to the NFS servers for the web
> servers to then export?

I'm not sure if I understand this question correctly.  The NFS server
(a NetApp, btw.) sees the new file contents correctly; all other web
servers also see non-corrupt new files.  Only the one web server which
performed the update saw broken files.

Max