On Fri, Apr 25, 2008 at 04:57:50AM -0400, Christoph Hellwig wrote:
> On Tue, Apr 22, 2008 at 03:04:48PM +1000, David Chinner wrote:
> > > I'm confused, why would an NFS client be trying to guess the generation
> > > number? AFAICS the important thing is to ensure that the (inode,gen)
> > > tuple isn't reused for a long time to prevent accidental filehandle
> > > identity issues on clients; whether the gen is predictable or not
> > > doesn't matter at all.
> >
> > Yeah, that's exactly what I said to Christoph, but that's the issue he
> > raised w.r.t a malicious client triggering inode/gen collisions
> > intentionally. If that's not a problem, then I can just use random32()
> > for the inode number. If it is a real problem, then it needs to be
> > a cryptographically secure random number. Personally, I don't care
> > either way - I just want to get the issue fixed.
> >
> > Christoph, care to explain how and why this is a problem to everyone?
>
> XFS has some heuristics for inode placement and of course for removing
> the inode cluster and re-allocting it. I have a gut feeling that there
> is a small chance to trigger a re-use via nfs operations. Making the
> initial generation number random means we remove one of the major
> user-triggerable inputs from the equation.
Ok, so is random32() good enough or does it need to be get_random_int()?
Cheers,
Dave.
--
Dave Chinner
Principal Engineer
SGI Australian Software Group
|