On 4/14/23 14:34, Sergei Shtepa wrote: > Subject: > Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module > From: > Sergei Shtepa > Date: > 4/14/23, 14:34 > > To: > Donald Buczek , axboe@kernel.dk, hch@infradead.org, corbet@lwn.net, snitzer@kernel.org > CC: > viro@zeniv.linux.org.uk, brauner@kernel.org, willy@infradead.org, kch@nvidia.com, martin.petersen@oracle.com, vkoul@kernel.org, ming.lei@redhat.com, gregkh@linuxfoundation.org, linux-block@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org > > > > On 4/12/23 21:38, Donald Buczek wrote: >> Subject: >> Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module >> From: >> Donald Buczek >> Date: >> 4/12/23, 21:38 >> >> To: >> Sergei Shtepa , axboe@kernel.dk, hch@infradead.org, corbet@lwn.net, snitzer@kernel.org >> CC: >> viro@zeniv.linux.org.uk, brauner@kernel.org, willy@infradead.org, kch@nvidia.com, martin.petersen@oracle.com, vkoul@kernel.org, ming.lei@redhat.com, gregkh@linuxfoundation.org, linux-block@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org >> >> >> I think, you can trigger all kind of user-after-free when userspace deletes a snapshot image or the snapshot image and the tracker while the disk device snapshot image is kept alive (mounted or just opened) and doing I/O. >> >> Here is what I did to provoke that: >> >> root@dose:~# s=$(blksnap snapshot_create -d /dev/vdb) >> root@dose:~# blksnap snapshot_appendstorage -i $s -f /scratch/local/test.dat >> device path: '/dev/block/253:2' >> allocate range: ofs=11264624 cnt=2097152 >> root@dose:~# blksnap snapshot_take -i $s >> root@dose:~# mount /dev/blksnap-image_253\:16 /mnt >> root@dose:~# dd if=/dev/zero of=/mnt/x.x & >> [1] 2514 >> root@dose:~# blksnap snapshot_destroy -i $s >> dd: writing to '/mnt/x.x': No space left on device >> 1996041+0 records in >> 1996040+0 records out >> 1021972480 bytes (1.0 GB, 975 MiB) copied, 8.48923 s, 120 MB/s >> [1]+  Exit 1                  dd if=/dev/zero of=/mnt/x.x >> > Thanks! > I am very glad that the blksnap tool turned out to be useful in the review. > This snapshot deletion scenario is not the most typical, but of course it is > quite possible. > I will need to solve this problem and add such a scenario to the test suite. > Hi! I have redesign the logic of ownership of the diff_area structure. See patch in attach or commit. Link: https://github.com/SergeiShtepa/linux/commit/7e927c381dcd2b2293be8315897a224d111b6f88 A test script for such a scenario has been added. Link: https://github.com/veeam/blksnap/commit/fd0559dfedf094901d08bbf185fed288f0156433 I will be glad of any feedback.