linux-kernel - Re: Does ceph_fill_inode() mishandle I

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <756af030a5085152f923e41b84746930b464af5d.camel@kernel.org>
Date: Thu, 13 Mar 2025 18:47:56 -0400
From: Jeff Layton <jlayton@...nel.org>
To: David Howells <dhowells@...hat.com>, slava@...eyko.com
Cc: Alex Markuze <amarkuze@...hat.com>, Xiubo Li <xiubli@...hat.com>, Ilya
 Dryomov <idryomov@...il.com>, Alexander Viro <viro@...iv.linux.org.uk>,
 Christian Brauner	 <brauner@...nel.org>, ceph-devel@...r.kernel.org,
 linux-fsdevel@...r.kernel.org, 	linux-kernel@...r.kernel.org,
 Slava.Dubeyko@....com
Subject: Re: Does ceph_fill_inode() mishandle I_NEW?

On Thu, 2025-03-13 at 20:47 +0000, David Howells wrote:
> slava@...eyko.com wrote:
> 
> > What do you mean by mishandling? Do you imply that Ceph has to set up
> > the I_NEW somehow? Is it not VFS responsibility?
> 
> No - I mean that if I_NEW *isn't* set when the function is called,
> ceph_fill_inode() will go and partially reinitialise the inode.  Now, having
> reviewed the code in more depth and talked to Jeff Layton about it, I think
> that the non-I_NEW pass will only change pointers with some sort of locking
> and will release the old target - though it may overwrite some pointers with
> the same value without protection (i_fops for example).
> 
> That said, if it's possible for *two* processes to be going through that
> function without I_NEW set, you can get places where both of them will try
> freeing the old data and replacing it with new without any locking - but I
> don't know if that can happen.
> 

I don't think that can happen. An I_NEW inode hasn't been properly
hashed yet, so nothing should be able to find it until
unlock_new_inode() is called.

-- 
Jeff Layton <jlayton@...nel.org>