[v5,00/26] fs: fixes for serious clone/dedupe problems

Message ID	153965939489.1256.7400115244528045860.stgit@magnolia (mailing list archive)
Headers	show Return-Path: <linux-fsdevel-owner@kernel.org> Subject: [PATCH v5 00/26] fs: fixes for serious clone/dedupe problems From: "Darrick J. Wong" <darrick.wong@oracle.com> To: david@fromorbit.com, darrick.wong@oracle.com Cc: sandeen@redhat.com, linux-nfs@vger.kernel.org, linux-cifs@vger.kernel.org, linux-unionfs@vger.kernel.org, linux-xfs@vger.kernel.org, linux-mm@kvack.org, linux-btrfs@vger.kernel.org, linux-fsdevel@vger.kernel.org, ocfs2-devel@oss.oracle.com Date: Mon, 15 Oct 2018 20:09:55 -0700 Message-ID: <153965939489.1256.7400115244528045860.stgit@magnolia> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk
Series	fs: fixes for serious clone/dedupe problems \| expand [v5,00/26] fs: fixes for serious clone/dedupe problems [01/26] xfs: add a per-xfs trace_printk macro [02/26] vfs: vfs_clone_file_prep_inodes should return EINVAL for a clone from beyond EOF [03/26] vfs: check file ranges before cloning files [04/26] vfs: exit early from zero length remap operations [05/26] vfs: strengthen checking of file range inputs to generic_remap_checks [06/26] vfs: avoid problematic remapping requests into partial EOF block [07/26] vfs: skip zero-length dedupe requests [08/26] vfs: rename vfs_clone_file_prep to be more descriptive [09/26] vfs: rename clone_verify_area to remap_verify_area [10/26] vfs: combine the clone and dedupe into a single remap_file_range [11/26] vfs: pass remap flags to generic_remap_file_range_prep [12/26] vfs: pass remap flags to generic_remap_checks [13/26] vfs: create generic_remap_file_range_touch to update inode metadata [14/26] vfs: make remap_file_range functions take and return bytes completed [15/26] vfs: plumb remap flags through the vfs clone functions [16/26] vfs: plumb remap flags through the vfs dedupe functions [17/26] vfs: enable remap callers that can handle short operations [18/26] vfs: hide file range comparison function [19/26] vfs: clean up generic_remap_file_range_prep return value [20/26] ocfs2: truncate page cache for clone destination file before remapping [21/26] ocfs2: fix pagecache truncation prior to reflink [22/26] ocfs2: support partial clone range and dedupe range [23/26] ocfs2: remove ocfs2_reflink_remap_range [24/26] xfs: fix pagecache truncation prior to reflink [25/26] xfs: support returning partial reflink results [26/26] xfs: remove redundant remap partial EOF block checks

Message ID

153965939489.1256.7400115244528045860.stgit@magnolia (mailing list archive)

Headers

Subject: [PATCH v5 00/26] fs: fixes for serious clone/dedupe problems
From: "Darrick J. Wong" <darrick.wong@oracle.com>
To: david@fromorbit.com, darrick.wong@oracle.com
Cc: sandeen@redhat.com, linux-nfs@vger.kernel.org,
        linux-cifs@vger.kernel.org, linux-unionfs@vger.kernel.org,
        linux-xfs@vger.kernel.org, linux-mm@kvack.org,
        linux-btrfs@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        ocfs2-devel@oss.oracle.com
Date: Mon, 15 Oct 2018 20:09:55 -0700
Message-ID: <153965939489.1256.7400115244528045860.stgit@magnolia>
User-Agent: StGit/0.17.1-dirty
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Sender: linux-fsdevel-owner@vger.kernel.org
Precedence: bulk

Series

fs: fixes for serious clone/dedupe problems | expand

Message

Darrick J. Wong Oct. 16, 2018, 3:09 a.m. UTC

Hi all,

Dave, Eric, and I have been chasing a stale data exposure bug in the XFS
reflink implementation, and tracked it down to reflink forgetting to do
some of the file-extending activities that must happen for regular
writes.

We then started auditing the clone, dedupe, and copyfile code and
realized that from a file contents perspective, clonerange isn't any
different from a regular file write. Unfortunately, we also noticed
that *unlike* a regular write, clonerange skips a ton of overflow
checks, such as validating the ranges against s_maxbytes, MAX_NON_LFS,
and RLIMIT_FSIZE. We also observed that cloning into a file did not
strip security privileges (suid, capabilities) like a regular write
would. I also noticed that xfs and ocfs2 need to dump the page cache
before remapping blocks, not after.

In fixing the range checking problems I also realized that both dedupe
and copyfile tell userspace how much of the requested operation was
acted upon. Since the range validation can shorten a clone request (or
we can ENOSPC midway through), we might as well plumb the short
operation reporting back through the VFS indirection code to userspace.

So, here's the whole giant pile of patches[1] that fix all the problems.
This branch is against current upstream (4.19-rc8). The patch
"generic: test reflink side effects" recently sent to fstests exercises
the fixes in this series. Tests are in [2].

--D

[1] https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux.git/log/?h=djwong-devel
[2] https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfstests-dev.git/log/?h=djwong-devel