[PATCH] eCryptfs: Fix dentry handling on create error, unlink, and inode destroy

[PATCH] eCryptfs: Fix dentry handling on create error, unlink, and inode destroy

[Michael Halcrow]

This patch corrects some erroneous dentry handling in eCryptfs.

If there is a problem creating the lower file, then there is nothing
that the persistent lower file can do to really help us. This patch
makes a vfs_create() failure in the lower filesystem always lead to an
unconditional do_create failure in eCryptfs.

Under certain sequences of operations, the eCryptfs dentry can remain
in the dcache after an unlink. This patch calls d_drop() on the
eCryptfs dentry to correct this.

eCryptfs has no business calling d_delete() directly on a lower
filesystem's dentry. This patch removes the call to d_delete() on the
lower persistent file's dentry in ecryptfs_destroy_inode().

(Thanks to David Kleikamp, Eric Sandeen, and Jeff Moyer for helping
identify and resolve this issue)

Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com>
---
 fs/ecryptfs/inode.c |   20 ++++----------------
 fs/ecryptfs/super.c |    1 -
 2 files changed, 4 insertions(+), 17 deletions(-)

diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 0b1ab01..5a71918 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -120,22 +120,9 @@ ecryptfs_do_create(struct inode *directory_inode,
 	rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode,
 					     ecryptfs_dentry, mode, nd);
 	if (rc) {
-		struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode;
-		struct ecryptfs_inode_info *inode_info =
-			ecryptfs_inode_to_private(ecryptfs_inode);
-
-		printk(KERN_WARNING "%s: Error creating underlying file; "
-		       "rc = [%d]; checking for existing\n", __FUNCTION__, rc);
-		if (inode_info) {
-			mutex_lock(&inode_info->lower_file_mutex);
-			if (!inode_info->lower_file) {
-				mutex_unlock(&inode_info->lower_file_mutex);
-				printk(KERN_ERR "%s: Failure to set underlying "
-				       "file; rc = [%d]\n", __FUNCTION__, rc);
-				goto out_lock;
-			}
-			mutex_unlock(&inode_info->lower_file_mutex);
-		}
+		printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
+		       "rc = [%d]\n", __FUNCTION__, rc);
+		goto out_lock;
 	}
 	rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
 				directory_inode->i_sb, 0);
@@ -451,6 +438,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
 	dentry->d_inode->i_nlink =
 		ecryptfs_inode_to_lower(dentry->d_inode)->i_nlink;
 	dentry->d_inode->i_ctime = dir->i_ctime;
+	d_drop(dentry);
 out_unlock:
 	unlock_parent(lower_dentry);
 	return rc;
diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c
index f8cdab2..4859c4e 100644
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -86,7 +86,6 @@ static void ecryptfs_destroy_inode(struct inode *inode)
 			fput(inode_info->lower_file);
 			inode_info->lower_file = NULL;
 			d_drop(lower_dentry);
-			d_delete(lower_dentry);
 		}
 	}
 	mutex_unlock(&inode_info->lower_file_mutex);
-- 
1.5.3.6

Re: [PATCH] eCryptfs: Fix dentry handling on create error, unlink, and inode destroy

[Andrew Morton]

On Mon, 7 Jan 2008 23:25:42 -0600 Michael Halcrow <mhalcrow@us.ibm.com> wrote:

> --- a/fs/ecryptfs/inode.c
> +++ b/fs/ecryptfs/inode.c
> @@ -120,22 +120,9 @@ ecryptfs_do_create(struct inode *directory_inode,
>  	rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode,
>  					     ecryptfs_dentry, mode, nd);
>  	if (rc) {
> -		struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode;
> -		struct ecryptfs_inode_info *inode_info =
> -			ecryptfs_inode_to_private(ecryptfs_inode);
> -
> -		printk(KERN_WARNING "%s: Error creating underlying file; "
> -		       "rc = [%d]; checking for existing\n", __FUNCTION__, rc);
> -		if (inode_info) {
> -			mutex_lock(&inode_info->lower_file_mutex);
> -			if (!inode_info->lower_file) {
> -				mutex_unlock(&inode_info->lower_file_mutex);
> -				printk(KERN_ERR "%s: Failure to set underlying "
> -				       "file; rc = [%d]\n", __FUNCTION__, rc);
> -				goto out_lock;
> -			}
> -			mutex_unlock(&inode_info->lower_file_mutex);
> -		}
> +		printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
> +		       "rc = [%d]\n", __FUNCTION__, rc);
> +		goto out_lock;
>  	}
>  	rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
>  				directory_inode->i_sb, 0);

Will this cause an undesirable log storm if the underlying fs runs out of
space?

Re: [PATCH] eCryptfs: Fix dentry handling on create error, unlink, and inode destroy

[Michael Halcrow]

On Mon, Jan 07, 2008 at 09:45:17PM -0800, Andrew Morton wrote:
> On Mon, 7 Jan 2008 23:25:42 -0600 Michael Halcrow <mhalcrow@us.ibm.com> wrote:
> 
> > --- a/fs/ecryptfs/inode.c
> > +++ b/fs/ecryptfs/inode.c
> > @@ -120,22 +120,9 @@ ecryptfs_do_create(struct inode *directory_inode,
> >  	rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode,
> >  					     ecryptfs_dentry, mode, nd);
> >  	if (rc) {
> > -		struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode;
> > -		struct ecryptfs_inode_info *inode_info =
> > -			ecryptfs_inode_to_private(ecryptfs_inode);
> > -
> > -		printk(KERN_WARNING "%s: Error creating underlying file; "
> > -		       "rc = [%d]; checking for existing\n", __FUNCTION__, rc);
> > -		if (inode_info) {
> > -			mutex_lock(&inode_info->lower_file_mutex);
> > -			if (!inode_info->lower_file) {
> > -				mutex_unlock(&inode_info->lower_file_mutex);
> > -				printk(KERN_ERR "%s: Failure to set underlying "
> > -				       "file; rc = [%d]\n", __FUNCTION__, rc);
> > -				goto out_lock;
> > -			}
> > -			mutex_unlock(&inode_info->lower_file_mutex);
> > -		}
> > +		printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
> > +		       "rc = [%d]\n", __FUNCTION__, rc);
> > +		goto out_lock;
> >  	}
> >  	rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
> >  				directory_inode->i_sb, 0);
> 
> Will this cause an undesirable log storm if the underlying fs runs
> out of space?

When you're bumping up against the end of your storage space, you will
get a lot more that just this message in your logs. There are printk's
in ecryptfs_write_lower(), ecryptfs_encrypt_page(), ecryptfs_write(),
and ecryptfs_write_metadata_to_contents() that will get pretty
noisy. Is it worth wrapping those in a higher level of verbosity?

Mike

Re: [PATCH] eCryptfs: Fix dentry handling on create error, unlink, and inode destroy

[Andrew Morton]

On Tue, 8 Jan 2008 15:58:07 -0600
Michael Halcrow <mhalcrow@us.ibm.com> wrote:

> > >  	rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
> > >  				directory_inode->i_sb, 0);
> > 
> > Will this cause an undesirable log storm if the underlying fs runs
> > out of space?
> 
> When you're bumping up against the end of your storage space, you will
> get a lot more that just this message in your logs. There are printk's
> in ecryptfs_write_lower(), ecryptfs_encrypt_page(), ecryptfs_write(),
> and ecryptfs_write_metadata_to_contents() that will get pretty
> noisy. Is it worth wrapping those in a higher level of verbosity?

The consequences of this can actually be pretty harmful.  syslogd typically
does sychronous writes so a random full disk can cause a seek storm over on
the log disk and a runaway ecryptfs-using application could pretty quickly
exhaust the space on the log disk.

So I'd suggest that sometime you go through the fs and find any such
user-triggerable printks and fix them up.  The most robust way of fixing
them up would be to delete them, or make them dependent on
CONFIG_ECRYPTFS_DEBUG.  Fiddling with the facility levels would help, but
it just lessens the probability rather than fixing it completely.