Re: strange ext{3,4}_settattr logic

[Dmitri Monakhov <dmonakhov@openvz.org>]

[-- Attachment #1: Type: text/plain, Size: 3549 bytes --]

I've added Jens because he may be also interesting in this topic.
On 08:23 Sun 16 Mar     , Andreas Dilger wrote:
> On Mar 16, 2008  07:54 +0800, Andreas Dilger wrote:
> > A call to  inode_setattr() can fail by trying a shrinking vmtruncate()
> > on a swapfile, which returns ETXTBUSY.  This was added after the
> > ext3_setattr() code was written.
> > 
> > We need to handle the IS_SWAPFILE() case properly.
> > Granted, it probably isn't a very common problem, but the IS_SWAPFILE()
> > check was added explicitly because of clueless users, so it must be hit
> > occasionally in real life.
> > 
> > It would seem that if you have a swapfile, try to truncate it to 0 (which
> > will fail with -ETXTBUSY) and then unmount the filesystem the size will
> > be truncated to 0.  It is also possible to directly write to a swapfile
> > and corrupt memory, or read from a swapfile and access potentially sensitive
> > information.
In fact i've triggered this issue while working on fast_loop device
implementation which was proposed by Jens (http://lkml.org/lkml/2008/1/9/50).
In fast_loop device use swapfile approach (submitting bio-s directly to
underlying block device). I think this idea will be included in mainstream
loop device sooner or later. But approach has several issues:
One of the most important is effective control mechanism over truncates for
lower file,  this issue was missed in Jens patch set.
This mechanism probably have to have following options.
#1: Shrink truncates must be denied.
#2: Expand truncates may be allowed. This is good because most of non plain 
disk image formats (qcow, vmdk, and etc) are growing while adding new data
blocks.
#3: Allow exclusive owner for file, for example only one user(loop_thread in
this case) may truncate file. Provide something similar to bd_claim feature.
without this feature on-line shrinking of disk image looks like this:

 mutex_lock(&inode->i_mutex);
 inode->i_flags &= ~S_SWAPFILE;
 mutex_unlock(&inode->i_mutex);

 /* Perform shrinking truncate. This is absolutely racy operation because
  * some one else also may perform truncate at this time*/
 do_truncate(inode, size); 

 mutex_lock(&inode->i_mutex);
 inode->i_flags |= S_SWAPFILE;
 mutex_unlock(&inode->i_mutex);


S_SWAPFILE inode option currently equals to #1, and #2. What's why i want
use this flag for fast_loop devices.

> 
> Dmitri, (or anyone)
> can you please give this patch a try.  It should be OK, but I'm hesitant
> to test it on my test box because I'm out of town and if it fails to
> reboot I can't fix it for a week.  It _should_ still be possible to chown,
> rename, ls, etc the swapfile, can you please verify that in addition
> to the simple test in my previous email.
> 
[snip]
> 
> 
> 
> --- linux-2.6.24/fs/namei.c.orig	2008-02-05 07:29:57.000000000 +0800
> +++ linux-2.6.24/fs/namei.c	2008-03-16 08:11:41.000000000 +0800
> @@ -233,6 +233,10 @@ int permission(struct inode *inode, int 
>  	if (nd)
>  		mnt = nd->mnt;
>  
> +	/* Don't allow direct read, write, or truncate on a swapfile */
Your patch disallow expand truncates (#2) which is definitely not good. 
In fact if file was opened before S_SWAPFILE flag was setted when it is
possible to directly read, write from file.
> +	if (IS_SWAPFILE(inode))
> +		return -ETXTBUSY;
> +
>  	if (mask & MAY_WRITE) {
>  		umode_t mode = inode->i_mode;

BTW it is impossible to disable swapfile with your patch 
[root@ts63 tmp]# swapoff  /vz/swap 
swapoff: /vz/swap: Text file busy

IMHO S_SWAPFILE flag must be checked in ext3_setattr, see patch attached:

[-- Attachment #2: swap_flag.patch --]
[-- Type: text/plain, Size: 463 bytes --]

diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index eb95670..0f74beb 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -3032,6 +3032,10 @@ int ext3_setattr(struct dentry *dentry, struct iattr *attr)
 	    attr->ia_valid & ATTR_SIZE && attr->ia_size < inode->i_size) {
 		handle_t *handle;
 
+		if (IS_SWAPFILE(inode)) {
+			rc = -ETXTBSY;
+			goto err_out;
+		}
 		handle = ext3_journal_start(inode, 3);
 		if (IS_ERR(handle)) {
 			error = PTR_ERR(handle);