Re: [PATCH] Don't initialise new inode generation numbers to zero V2

[Christoph Hellwig <hch@infradead.org>]

On Tue, Apr 22, 2008 at 03:04:48PM +1000, David Chinner wrote:
> > I'm confused, why would an NFS client be trying to guess the generation
> > number?  AFAICS the important thing is to ensure that the (inode,gen)
> > tuple isn't reused for a long time to prevent accidental filehandle
> > identity issues on clients; whether the gen is predictable or not
> > doesn't matter at all.
> 
> Yeah, that's exactly what I said to Christoph, but that's the issue he
> raised w.r.t a malicious client triggering inode/gen collisions
> intentionally. If that's not a problem, then I can just use random32()
> for the inode number. If it is a real problem, then it needs to be
> a cryptographically secure random number. Personally, I don't care
> either way - I just want to get the issue fixed.
> 
> Christoph, care to explain how and why this is a problem to everyone?

XFS has some heuristics for inode placement and of course for removing
the inode cluster and re-allocting it.  I have a gut feeling that there
is a small chance to trigger a re-use via nfs operations.  Making the
initial generation number random means we remove one of the major
user-triggerable inputs from the equation.