linux-kernel - Re: [PATCH] fs: support filename refcount without atomics

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGudoHFE8D4itzs=DC14cJpRo-SNqJTz7J4g5B0VsjrNuE0_pA@mail.gmail.com>
Date: Fri, 7 Mar 2025 17:35:15 +0100
From: Mateusz Guzik <mjguzik@...il.com>
To: Jens Axboe <axboe@...nel.dk>
Cc: brauner@...nel.org, viro@...iv.linux.org.uk, jack@...e.cz, 
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org, 
	io-uring@...r.kernel.org, audit@...r.kernel.org
Subject: Re: [PATCH] fs: support filename refcount without atomics

On Fri, Mar 7, 2025 at 5:32 PM Jens Axboe <axboe@...nel.dk> wrote:
>
> On 3/7/25 9:25 AM, Mateusz Guzik wrote:
> > On Fri, Mar 7, 2025 at 5:18?PM Jens Axboe <axboe@...nel.dk> wrote:
> >>
> >>> +static inline void makeatomicname(struct filename *name)
> >>> +{
> >>> +     VFS_BUG_ON(IS_ERR_OR_NULL(name));
> >>> +     /*
> >>> +      * The name can legitimately already be atomic if it was cached by audit.
> >>> +      * If switching the refcount to atomic, we need not to know we are the
> >>> +      * only non-atomic user.
> >>> +      */
> >>> +     VFS_BUG_ON(name->owner != current && !name->is_atomic);
> >>> +     /*
> >>> +      * Don't bother branching, this is a store to an already dirtied cacheline.
> >>> +      */
> >>> +     name->is_atomic = true;
> >>> +}
> >>
> >> Should this not depend on audit being enabled? io_uring without audit is
> >> fine.
> >>
> >
> > I thought about it, but then I got worried about transitions from
> > disabled to enabled -- will they suddenly start looking here? Should
> > this test for audit_enabled, audit_dummy_context() or something else?
> > I did not want to bother analyzing this.
>
> Let me take a look at it, the markings for when to switch atomic are not
> accurate - it only really needs to happen for offload situations only,
> and if audit is enabled and tracking. So I think we can great improve
> upon this patch.
>

I aimed for this to be a NOP for io_uring, so to speak, specifically
because I could not be arsed to deal with audit.

> > I'll note though this would be an optimization on top of the current
> > code, so I don't think it *blocks* the patch.
>
> Let's not go with something half-done if we can get it right the first
> time.
>

Since you volunteered to sort this out, I'll be happy to wait.
-- 
Mateusz Guzik <mjguzik gmail.com>