linux-kernel - Re: Does ceph_fill_inode() mishandle I

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1468676.1741898867@warthog.procyon.org.uk>
Date: Thu, 13 Mar 2025 20:47:47 +0000
From: David Howells <dhowells@...hat.com>
To: slava@...eyko.com
Cc: dhowells@...hat.com, Alex Markuze <amarkuze@...hat.com>,
    Xiubo Li <xiubli@...hat.com>, Ilya Dryomov <idryomov@...il.com>,
    Jeff Layton <jlayton@...nel.org>,
    Alexander Viro <viro@...iv.linux.org.uk>,
    Christian Brauner <brauner@...nel.org>, ceph-devel@...r.kernel.org,
    linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
    Slava.Dubeyko@....com
Subject: Re: Does ceph_fill_inode() mishandle I_NEW?

slava@...eyko.com wrote:

> What do you mean by mishandling? Do you imply that Ceph has to set up
> the I_NEW somehow? Is it not VFS responsibility?

No - I mean that if I_NEW *isn't* set when the function is called,
ceph_fill_inode() will go and partially reinitialise the inode.  Now, having
reviewed the code in more depth and talked to Jeff Layton about it, I think
that the non-I_NEW pass will only change pointers with some sort of locking
and will release the old target - though it may overwrite some pointers with
the same value without protection (i_fops for example).

That said, if it's possible for *two* processes to be going through that
function without I_NEW set, you can get places where both of them will try
freeing the old data and replacing it with new without any locking - but I
don't know if that can happen.

David