Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module

[Donald Buczek]

On 4/18/23 12:31, Sergei Shtepa wrote:
> On 4/14/23 14:34, Sergei Shtepa wrote:
> > Subject:
> > Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module
> > From:
> > Sergei Shtepa <sergei.shtepa@xxxxxxxxx>
> > Date:
> > 4/14/23, 14:34
> >
> > To:
> > Donald Buczek <buczek@xxxxxxxxxxxxx>, axboe@xxxxxxxxx, hch@xxxxxxxxxxxxx, corbet@xxxxxxx, snitzer@xxxxxxxxxx
> > CC:
> > viro@xxxxxxxxxxxxxxxxxx, brauner@xxxxxxxxxx, willy@xxxxxxxxxxxxx, kch@xxxxxxxxxx, martin.petersen@xxxxxxxxxx, vkoul@xxxxxxxxxx, ming.lei@xxxxxxxxxx, gregkh@xxxxxxxxxxxxxxxxxxx, linux-block@xxxxxxxxxxxxxxx, linux-doc@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx
> >
> >
> >
> > On 4/12/23 21:38, Donald Buczek wrote:
> > > Subject:
> > > Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module
> > > From:
> > > Donald Buczek <buczek@xxxxxxxxxxxxx>
> > > Date:
> > > 4/12/23, 21:38
> > >
> > > To:
> > > Sergei Shtepa <sergei.shtepa@xxxxxxxxx>, axboe@xxxxxxxxx, hch@xxxxxxxxxxxxx, corbet@xxxxxxx, snitzer@xxxxxxxxxx
> > > CC:
> > > viro@xxxxxxxxxxxxxxxxxx, brauner@xxxxxxxxxx, willy@xxxxxxxxxxxxx, kch@xxxxxxxxxx, martin.petersen@xxxxxxxxxx, vkoul@xxxxxxxxxx, ming.lei@xxxxxxxxxx, gregkh@xxxxxxxxxxxxxxxxxxx, linux-block@xxxxxxxxxxxxxxx, linux-doc@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx
> > >
> > >
> > > I think, you can trigger all kind of user-after-free when userspace deletes a snapshot image or the snapshot image and the tracker while the disk device snapshot image is kept alive (mounted or just opened) and doing I/O.
> > >
> > > Here is what I did to provoke that:
> > >
> > > root@dose:~# s=$(blksnap snapshot_create -d /dev/vdb)
> > > root@dose:~# blksnap snapshot_appendstorage -i $s -f /scratch/local/test.dat
> > > device path: '/dev/block/253:2'
> > > allocate range: ofs=11264624 cnt=2097152
> > > root@dose:~# blksnap snapshot_take -i $s
> > > root@dose:~# mount /dev/blksnap-image_253\:16 /mnt
> > > root@dose:~# dd if=/dev/zero of=/mnt/x.x &
> > > [1] 2514
> > > root@dose:~# blksnap snapshot_destroy -i $s
> > > dd: writing to '/mnt/x.x': No space left on device
> > > 1996041+0 records in
> > > 1996040+0 records out
> > > 1021972480 bytes (1.0 GB, 975 MiB) copied, 8.48923 s, 120 MB/s
> > > [1]+  Exit 1                  dd if=/dev/zero of=/mnt/x.x
> > Thanks!
> > I am very glad that the blksnap tool turned out to be useful in the review.
> > This snapshot deletion scenario is not the most typical, but of course it is
> > quite possible.
> > I will need to solve this problem and add such a scenario to the test suite.
>
> Hi!
>
> I have redesign the logic of ownership of the diff_area structure.
> See patch in attach or commit.
> Link: https://github.com/SergeiShtepa/linux/commit/7e927c381dcd2b2293be8315897a224d111b6f88
> A test script for such a scenario has been added.
> Link: https://github.com/veeam/blksnap/commit/fd0559dfedf094901d08bbf185fed288f0156433
>
> I will be glad of any feedback.

Great, Thanks!

However, there are two leftover calls to diff_area_free() with its old prototype:

 CC [M]  drivers/block/blksnap/diff_area.o
drivers/block/blksnap/diff_area.c: In function ‘diff_area_new’:
drivers/block/blksnap/diff_area.c:283:18: error: passing argument 1 of ‘diff_area_free’ from incompatible pointer type [-Werror=incompatible-pointer-types]
  283 |   diff_area_free(diff_area);
      |                  ^~~~~~~~~
      |                  |
      |                  struct diff_area *
drivers/block/blksnap/diff_area.c:110:34: note: expected ‘struct kref *’ but argument is of type ‘struct diff_area *’
  110 | void diff_area_free(struct kref *kref)
      |                     ~~~~~~~~~~~~~^~~~
cc1: some warnings being treated as errors
make[4]: *** [scripts/Makefile.build:252: drivers/block/blksnap/diff_area.o] Error 1
make[3]: *** [scripts/Makefile.build:494: drivers/block/blksnap] Error 2
make[2]: *** [scripts/Makefile.build:494: drivers/block] Error 2
make[1]: *** [scripts/Makefile.build:494: drivers] Error 2
make: *** [Makefile:2025: .] Error 2

The other one:

buczek@dose:/scratch/local/linux (blksnap-test)$ make drivers/block/blksnap/tracker.o
  CALL    scripts/checksyscalls.sh
  DESCEND objtool
  INSTALL libsubcmd_headers
  CC [M]  drivers/block/blksnap/tracker.o
drivers/block/blksnap/tracker.c: In function ‘tracker_free’:
drivers/block/blksnap/tracker.c:26:25: error: passing argument 1 of ‘diff_area_free’ from incompatible pointer type [-Werror=incompatible-pointer-types]
   26 |   diff_area_free(tracker->diff_area);
      |                  ~~~~~~~^~~~~~~~~~~
      |                         |
      |                         struct diff_area *
In file included from drivers/block/blksnap/tracker.c:12:
drivers/block/blksnap/diff_area.h:116:34: note: expected ‘struct kref *’ but argument is of type ‘struct diff_area *’
  116 | void diff_area_free(struct kref *kref);
      |                     ~~~~~~~~~~~~~^~~~
cc1: some warnings being treated as errors
make[4]: *** [scripts/Makefile.build:252: drivers/block/blksnap/tracker.o] Error 1
make[3]: *** [scripts/Makefile.build:494: drivers/block/blksnap] Error 2
make[2]: *** [scripts/Makefile.build:494: drivers/block] Error 2
make[1]: *** [scripts/Makefile.build:494: drivers] Error 2
make: *** [Makefile:2025: .] Error 2

Am I missing something?

Best
  Donald

--
Donald Buczek
buczek@xxxxxxxxxxxxx
Tel: +49 30 8413 1433