xfs
[Top] [All Lists]

Re: [PATCH] Don't initialise new inode generation numbers to zero V2

To: David Chinner <dgc@xxxxxxx>
Subject: Re: [PATCH] Don't initialise new inode generation numbers to zero V2
From: Christoph Hellwig <hch@xxxxxxxxxxxxx>
Date: Fri, 25 Apr 2008 04:57:50 -0400
Cc: Greg Banks <gnb@xxxxxxxxxxxxxxxxx>, xfs-dev <xfs-dev@xxxxxxx>, xfs-oss <xfs@xxxxxxxxxxx>
In-reply-to: <20080422050447.GV103491721@xxxxxxx>
References: <20080422015806.GU108924158@xxxxxxx> <480D641B.8060301@xxxxxxxxxxxxxxxxx> <20080422050447.GV103491721@xxxxxxx>
Sender: xfs-bounce@xxxxxxxxxxx
User-agent: Mutt/1.5.17 (2007-11-01)
On Tue, Apr 22, 2008 at 03:04:48PM +1000, David Chinner wrote:
> > I'm confused, why would an NFS client be trying to guess the generation
> > number?  AFAICS the important thing is to ensure that the (inode,gen)
> > tuple isn't reused for a long time to prevent accidental filehandle
> > identity issues on clients; whether the gen is predictable or not
> > doesn't matter at all.
> 
> Yeah, that's exactly what I said to Christoph, but that's the issue he
> raised w.r.t a malicious client triggering inode/gen collisions
> intentionally. If that's not a problem, then I can just use random32()
> for the inode number. If it is a real problem, then it needs to be
> a cryptographically secure random number. Personally, I don't care
> either way - I just want to get the issue fixed.
> 
> Christoph, care to explain how and why this is a problem to everyone?

XFS has some heuristics for inode placement and of course for removing
the inode cluster and re-allocting it.  I have a gut feeling that there
is a small chance to trigger a re-use via nfs operations.  Making the
initial generation number random means we remove one of the major
user-triggerable inputs from the equation.


<Prev in Thread] Current Thread [Next in Thread>