Re: [PATCH v2] Add ioctls to get/set the ext4 superblock uuid.

On Mon, Jul 11, 2022 at 09:33:00PM -0700, Jeremy Bongio wrote:

On Tue, Jul 5, 2022 at 10:07 AM Darrick J. Wong [off-list ref] wrote:

quoted

On Fri, Jul 01, 2022 at 01:11:23PM -0700, Jeremy Bongio wrote:

quoted

This fixes a race between changing the ext4 superblock uuid and operations
like mounting, resizing, changing features, etc.

Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jeremy Bongio <redacted>
---
 fs/ext4/ext4.h  | 13 ++++++++
 fs/ext4/ioctl.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 96 insertions(+)

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 75b8d81b2469..0cf960cb591e 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h

@@ -724,6 +724,8 @@ enum {
 #define EXT4_IOC_GETSTATE            _IOW('f', 41, __u32)
 #define EXT4_IOC_GET_ES_CACHE                _IOWR('f', 42, struct fiemap)
 #define EXT4_IOC_CHECKPOINT          _IOW('f', 43, __u32)
+#define EXT4_IOC_GETFSUUID           _IOR('f', 44, struct fsuuid)
+#define EXT4_IOC_SETFSUUID           _IOW('f', 44, struct fsuuid)

 #define EXT4_IOC_SHUTDOWN _IOR ('X', 125, __u32)

@@ -753,6 +755,17 @@ enum {
                                              EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT | \
                                              EXT4_IOC_CHECKPOINT_FLAG_DRY_RUN)

+/*
+ * Structure for EXT4_IOC_GETFSUUID/EXT4_IOC_SETFSUUID
+ */
+struct fsuuid {
+     __u32       fu_len;
+     __u32       fu_flags;
+     __u8 __user fu_uuid[];

__user is unnecessary here -- it applies to pointers, not to struct
members.

quoted

+};
+
+#define EXT4_IOC_SETFSUUID_FLAG_BLOCKING 0x1

What does this do?

(Better yet, can you please write a manpage describing these new
ioctls?)

Good idea. I'll write a manpage as if it were being converted to a general ioctl
and not specific to ext4.

Thank you. :)

quoted

quoted

+
 #if defined(__KERNEL__) && defined(CONFIG_COMPAT)
 /*
  * ioctl commands in 32 bit emulation

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index cb01c1da0f9d..75069afc16ae 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c

@@ -20,6 +20,7 @@
 #include <linux/delay.h>
 #include <linux/iversion.h>
 #include <linux/fileattr.h>
+#include <linux/uuid.h>
 #include "ext4_jbd2.h"
 #include "ext4.h"
 #include <linux/fsmap.h>

@@ -41,6 +42,15 @@ static void ext4_sb_setlabel(struct ext4_super_block *es, const void *arg)
      memcpy(es->s_volume_name, (char *)arg, EXT4_LABEL_MAX);
 }

+/*
+ * Superblock modification callback function for changing file system
+ * UUID.
+ */
+static void ext4_sb_setuuid(struct ext4_super_block *es, const void *arg)
+{
+     memcpy(es->s_uuid, (__u8 *)arg, UUID_SIZE);
+}
+
 static
 int ext4_update_primary_sb(struct super_block *sb, handle_t *handle,
                         ext4_update_sb_callback func,

@@ -1131,6 +1141,73 @@ static int ext4_ioctl_getlabel(struct ext4_sb_info *sbi, char __user *user_label
      return 0;
 }

+static int ext4_ioctl_getuuid(struct ext4_sb_info *sbi,
+                     struct fsuuid __user *ufsuuid)
+{
+     int ret = 0;
+     __u8 uuid[UUID_SIZE];

Save some stack space and copy sbi->s_es->s_uuid into fsuuid.fu_uuid,
and then copy_to_user from the kernel stack object out to userspace's
object.

I can't copy sbi->s_es->s_uuid into fsuuid.fu_uuid since fu_uuid is a
VLA (size 0 array).
Are you suggesting I copy_to_user() from sbi->s_es->s_uuid into
ufsuuid within the locked region?

No, I'd ... forgotten my own previous suggestion, so please ignore this.

quoted

quoted

+     struct fsuuid fsuuid;
+
+     if (copy_from_user(&fsuuid, ufsuuid, sizeof(fsuuid)))
+             return -EFAULT;
+
+     if (fsuuid.fu_len != UUID_SIZE)
+             return -EINVAL;

This function needs to check that fsuuid.fu_flags doesn't contain any
unknown bitflags.

quoted

+
+     lock_buffer(sbi->s_sbh);
+     memcpy(uuid, sbi->s_es->s_uuid, UUID_SIZE);
+     unlock_buffer(sbi->s_sbh);
+
+     if (copy_to_user(&ufsuuid->fu_uuid[0], uuid, UUID_SIZE))
+             ret = -EFAULT;
+     return ret;

        if (copy_to_user(...))
                return -EFAULT;

        return 0;

?

quoted

+}
+
+static int ext4_ioctl_setuuid(struct file *filp,
+                     const struct fsuuid __user *ufsuuid)
+{
+     int ret = 0;
+     struct super_block *sb = file_inode(filp)->i_sb;
+     struct fsuuid fsuuid;
+     __u8 uuid[UUID_SIZE];
+
+     if (!capable(CAP_SYS_ADMIN))
+             return -EPERM;
+
+     /*
+      * If any checksums (group descriptors or metadata) are being used
+      * then the checksum seed feature is required to change the UUID.
+      */
+     if (((ext4_has_feature_gdt_csum(sb) || ext4_has_metadata_csum(sb))
+                     && !ext4_has_feature_csum_seed(sb))
+             || ext4_has_feature_stable_inodes(sb))
+             return -EOPNOTSUPP;
+
+     if (copy_from_user(&fsuuid, ufsuuid, sizeof(fsuuid)))
+             return -EFAULT;
+
+     if (fsuuid.fu_len != UUID_SIZE)
+             return -EINVAL;

This function needs to check that fsuuid.fu_flags doesn't contain any
unknown bits.

quoted

+
+     if (copy_from_user(uuid, &ufsuuid->fu_uuid[0], UUID_SIZE))
+             return -EFAULT;
+
+     ret = mnt_want_write_file(filp);
+     if (ret)
+             return ret;
+
+     do {
+             if (ret == -EBUSY)
+                     msleep(1000);
+             ret = ext4_update_superblocks_fn(sb, ext4_sb_setuuid, &uuid);
+     } while (ret == -EBUSY &&
+             fsuuid.fu_flags & EXT4_IOC_SETFSUUID_FLAG_BLOCKING);

So... I guess by default, userspace gets NOWAIT mode?  That's a little
strange, usually kernel convention is blocking mode by default, with
nowait selectable via function flags.

Also, what's the intended use case here?  Why would we want to set a
uuid but only if the superblock(s) aren't busy?

When an ext4 filesystem is being resized, which could potentially take
a long time,
ext4_update_superblocks_fn() will return -EBUSY. In that case we can
either sleep and retry,
or return EBUSY to userspace. However, for my use case, I only care
about the blocking case.
I'll remove the flag since the default mode will be blocking.

<nod>

--D

quoted

--D

quoted

+
+     mnt_drop_write_file(filp);
+
+     return ret;
+}
+
 static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
      struct inode *inode = file_inode(filp);

@@ -1509,6 +1586,10 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
              return ext4_ioctl_setlabel(filp,
                                         (const void __user *)arg);

+     case EXT4_IOC_GETFSUUID:
+             return ext4_ioctl_getuuid(EXT4_SB(sb), (void __user *)arg);
+     case EXT4_IOC_SETFSUUID:
+             return ext4_ioctl_setuuid(filp, (const void __user *)arg);
      default:
              return -ENOTTY;
      }

@@ -1586,6 +1667,8 @@ long ext4_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
      case EXT4_IOC_CHECKPOINT:
      case FS_IOC_GETFSLABEL:
      case FS_IOC_SETFSLABEL:
+     case EXT4_IOC_GETFSUUID:
+     case EXT4_IOC_SETFSUUID:
              break;
      default:
              return -ENOIOCTLCMD;
--

2.37.0.rc0.161.g10f37bed90-goog