linux-btrfs.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Darrick J. Wong" <darrick.wong@oracle.com>
To: david@fromorbit.com, darrick.wong@oracle.com
Cc: sandeen@redhat.com, linux-nfs@vger.kernel.org,
	linux-cifs@vger.kernel.org, linux-unionfs@vger.kernel.org,
	linux-xfs@vger.kernel.org, linux-mm@kvack.org,
	linux-btrfs@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	ocfs2-devel@oss.oracle.com
Subject: [PATCH v4 00/25] fs: fixes for serious clone/dedupe problems
Date: Fri, 12 Oct 2018 17:05:29 -0700	[thread overview]
Message-ID: <153938912912.8361.13446310416406388958.stgit@magnolia> (raw)

Hi all,

Dave, Eric, and I have been chasing a stale data exposure bug in the XFS
reflink implementation, and tracked it down to reflink forgetting to do
some of the file-extending activities that must happen for regular
writes.

We then started auditing the clone, dedupe, and copyfile code and
realized that from a file contents perspective, clonerange isn't any
different from a regular file write.  Unfortunately, we also noticed
that *unlike* a regular write, clonerange skips a ton of overflow
checks, such as validating the ranges against s_maxbytes, MAX_NON_LFS,
and RLIMIT_FSIZE.  We also observed that cloning into a file did not
strip security privileges (suid, capabilities) like a regular write
would.  I also noticed that xfs and ocfs2 need to dump the page cache
before remapping blocks, not after.

In fixing the range checking problems I also realized that both dedupe
and copyfile tell userspace how much of the requested operation was
acted upon.  Since the range validation can shorten a clone request (or
we can ENOSPC midway through), we might as well plumb the short
operation reporting back through the VFS indirection code to userspace.

So, here's the whole giant pile of patches[1] that fix all the problems.
This branch is against current upstream (4.19-rc7+).  The patch
"generic: test reflink side effects" recently sent to fstests exercises
the fixes in this series.  Tests are in [2].

--D

[1] https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux.git/log/?h=djwong-devel
[2] https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfstests-dev.git/log/?h=djwong-devel

             reply	other threads:[~2018-10-13  0:05 UTC|newest]

Thread overview: 50+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-13  0:05 Darrick J. Wong [this message]
2018-10-13  0:05 ` [PATCH 01/25] xfs: add a per-xfs trace_printk macro Darrick J. Wong
2018-10-13  0:05 ` [PATCH 02/25] vfs: vfs_clone_file_prep_inodes should return EINVAL for a clone from beyond EOF Darrick J. Wong
2018-10-13  0:06 ` [PATCH 03/25] vfs: check file ranges before cloning files Darrick J. Wong
2018-10-13  0:06 ` [PATCH 04/25] vfs: strengthen checking of file range inputs to generic_remap_checks Darrick J. Wong
2018-10-13  0:06 ` [PATCH 05/25] vfs: avoid problematic remapping requests into partial EOF block Darrick J. Wong
2018-10-14 17:11   ` Christoph Hellwig
2018-10-13  0:06 ` [PATCH 06/25] vfs: skip zero-length dedupe requests Darrick J. Wong
2018-10-13  0:06 ` [PATCH 07/25] vfs: combine the clone and dedupe into a single remap_file_range Darrick J. Wong
2018-10-14 17:19   ` Christoph Hellwig
2018-10-15  6:04     ` Amir Goldstein
2018-10-15 12:47       ` Christoph Hellwig
2018-10-15 12:54         ` Amir Goldstein
2018-10-15 17:13         ` Darrick J. Wong
2018-10-15 18:32           ` Christoph Hellwig
2018-10-15 13:18     ` Matthew Wilcox
2018-10-15 16:42     ` Darrick J. Wong
2018-10-13  0:06 ` [PATCH 08/25] vfs: rename vfs_clone_file_prep to be more descriptive Darrick J. Wong
2018-10-13  0:06 ` [PATCH 09/25] vfs: rename clone_verify_area to remap_verify_area Darrick J. Wong
2018-10-13  0:06 ` [PATCH 10/25] vfs: create generic_remap_file_range_touch to update inode metadata Darrick J. Wong
2018-10-14 17:21   ` Christoph Hellwig
2018-10-15 16:30     ` Darrick J. Wong
2018-10-15 18:19       ` Christoph Hellwig
2018-10-13  0:06 ` [PATCH 11/25] vfs: pass remap flags to generic_remap_file_range_prep Darrick J. Wong
2018-10-14 17:22   ` Christoph Hellwig
2018-10-14 17:37   ` Christoph Hellwig
2018-10-15 15:42     ` Darrick J. Wong
2018-10-13  0:07 ` [PATCH 12/25] vfs: pass remap flags to generic_remap_checks Darrick J. Wong
2018-10-13  0:07 ` [PATCH 13/25] vfs: make remap_file_range functions take and return bytes completed Darrick J. Wong
2018-10-13  0:07 ` [PATCH 14/25] vfs: plumb RFR_* remap flags through the vfs clone functions Darrick J. Wong
2018-10-13  0:07 ` [PATCH 15/25] vfs: plumb RFR_* remap flags through the vfs dedupe functions Darrick J. Wong
2018-10-13  0:07 ` [PATCH 16/25] vfs: make remapping to source file eof more explicit Darrick J. Wong
2018-10-14 17:24   ` Christoph Hellwig
2018-10-15 15:32     ` Darrick J. Wong
2018-10-15 18:28       ` Christoph Hellwig
2018-10-13  0:07 ` [PATCH 17/25] vfs: enable remap callers that can handle short operations Darrick J. Wong
2018-10-13  0:07 ` [PATCH 18/25] vfs: hide file range comparison function Darrick J. Wong
2018-10-14 17:43   ` Christoph Hellwig
2018-10-13  0:07 ` [PATCH 19/25] vfs: implement opportunistic short dedupe Darrick J. Wong
2018-10-14 17:26   ` Christoph Hellwig
2018-10-13  0:08 ` [PATCH 20/25] ocfs2: truncate page cache for clone destination file before remapping Darrick J. Wong
2018-10-13  0:08 ` [PATCH 21/25] ocfs2: fix pagecache truncation prior to reflink Darrick J. Wong
2018-10-13  0:08 ` [PATCH 22/25] ocfs2: support partial clone range and dedupe range Darrick J. Wong
2018-10-14 17:41   ` Christoph Hellwig
2018-10-13  0:08 ` [PATCH 23/25] xfs: fix pagecache truncation prior to reflink Darrick J. Wong
2018-10-13  0:08 ` [PATCH 24/25] xfs: support returning partial reflink results Darrick J. Wong
2018-10-14 17:35   ` Christoph Hellwig
2018-10-14 23:05     ` Dave Chinner
2018-10-15 15:49       ` Darrick J. Wong
2018-10-13  0:08 ` [PATCH 25/25] xfs: remove redundant remap partial EOF block checks Darrick J. Wong

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=153938912912.8361.13446310416406388958.stgit@magnolia \
    --to=darrick.wong@oracle.com \
    --cc=david@fromorbit.com \
    --cc=linux-btrfs@vger.kernel.org \
    --cc=linux-cifs@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=linux-nfs@vger.kernel.org \
    --cc=linux-unionfs@vger.kernel.org \
    --cc=linux-xfs@vger.kernel.org \
    --cc=ocfs2-devel@oss.oracle.com \
    --cc=sandeen@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).