On Tue, Apr 22, 2008 at 03:04:48PM +1000, David Chinner wrote:
> > I'm confused, why would an NFS client be trying to guess the generation
> > number? AFAICS the important thing is to ensure that the (inode,gen)
> > tuple isn't reused for a long time to prevent accidental filehandle
> > identity issues on clients; whether the gen is predictable or not
> > doesn't matter at all.
> Yeah, that's exactly what I said to Christoph, but that's the issue he
> raised w.r.t a malicious client triggering inode/gen collisions
> intentionally. If that's not a problem, then I can just use random32()
> for the inode number. If it is a real problem, then it needs to be
> a cryptographically secure random number. Personally, I don't care
> either way - I just want to get the issue fixed.
> Christoph, care to explain how and why this is a problem to everyone?
XFS has some heuristics for inode placement and of course for removing
the inode cluster and re-allocting it. I have a gut feeling that there
is a small chance to trigger a re-use via nfs operations. Making the
initial generation number random means we remove one of the major
user-triggerable inputs from the equation.