From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60D96C43334 for ; Wed, 13 Jul 2022 23:48:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231561AbiGMXs1 (ORCPT ); Wed, 13 Jul 2022 19:48:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56306 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230371AbiGMXsZ (ORCPT ); Wed, 13 Jul 2022 19:48:25 -0400 Received: from mail105.syd.optusnet.com.au (mail105.syd.optusnet.com.au [211.29.132.249]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 203E74D4D3 for ; Wed, 13 Jul 2022 16:48:25 -0700 (PDT) Received: from dread.disaster.area (pa49-181-2-147.pa.nsw.optusnet.com.au [49.181.2.147]) by mail105.syd.optusnet.com.au (Postfix) with ESMTPS id 29ED110E8110; Thu, 14 Jul 2022 09:48:22 +1000 (AEST) Received: from dave by dread.disaster.area with local (Exim 4.92.3) (envelope-from ) id 1oBm5c-000a61-Gk; Thu, 14 Jul 2022 09:48:20 +1000 Date: Thu, 14 Jul 2022 09:48:20 +1000 From: Dave Chinner To: Linus Torvalds Cc: "Darrick J. Wong" , Josef Bacik , ansgar.loesser@kom.tu-darmstadt.de, Christoph Hellwig , Amir Goldstein , Mark Fasheh , Matthew Wilcox , Miklos Szeredi , Al Viro , linux-fsdevel , Security Officers , Max Schlecht , =?iso-8859-1?Q?Bj=F6rn?= Scheuermann Subject: Re: Information Leak: FIDEDUPERANGE ioctl allows reading writeonly files Message-ID: <20220713234820.GF3600936@dread.disaster.area> References: <20220713064631.GC3600936@dread.disaster.area> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Optus-CM-Score: 0 X-Optus-CM-Analysis: v=2.4 cv=OJNEYQWB c=1 sm=1 tr=0 ts=62cf59c8 a=ivVLWpVy4j68lT4lJFbQgw==:117 a=ivVLWpVy4j68lT4lJFbQgw==:17 a=kj9zAlcOel0A:10 a=RgO8CyIxsXoA:10 a=7-415B0cAAAA:8 a=eYdKgMM6oUqLe4G3ecEA:9 a=CjuIK1q_8ugA:10 a=biEYGPWJfzWAr4FL6Ov7:22 Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org On Wed, Jul 13, 2022 at 01:16:37AM -0700, Linus Torvalds wrote: > > Can we please all agree that this code is too obscure for its own good? Oh, there's no denying that, or that the API is .... poor. The problem is that touching this code has a very high validation burden. Like Darrick, I'm familiar with this code because we were the poor shmucks who decided dedupe needed data integrity testing before we could support it in XFS. Three months of finding and fixing data corruption after data corruption in the ioctl/vfs layers and tens of billions of fsx ops later... ... and the code has really not changed very much since then. That's the fundamental problem with rewriting this code - validating that changes have not introduced new data corruption bugs on XFS, btrfs, NFS and other idedupe supporting filesystems is time consuming and resource intensive. And it can't be skipped, because corrupting user data is even worse than breaking userspace applications (i.e. you can fix the kernel so the apps run again, but corrupted data is gone forever). So while the code might be somewhat inscrutible for outsiders with no familiarity of the dedupe/clone APIs or it's required behaviours, it works as advertised and doesn't corrupt data. Hence for the past few years the rule "don't try to fix what ain't broke" has applied - we've all got plenty of stuff that is actually broken or deficient and needs to be fixed to deal with first.... Cheers, Dave. -- Dave Chinner david@fromorbit.com