Project

General

Profile

Actions

Bug #55725

open

MDS allows a (kernel) client to exceed the xattrs key/value limits

Added by Luis Henriques almost 2 years ago. Updated 2 months ago.

Status:
Pending Backport
Priority:
Normal
Category:
Correctness/Safety
Target version:
% Done:

0%

Source:
Tags:
backport_processed
Backport:
reef,quincy,pacific
Regression:
No
Severity:
2 - major
Reviewed:
Affected Versions:
ceph-qa-suite:
Component(FS):
Client, MDS
Labels (FS):
Pull request ID:
Crash signature (v1):
Crash signature (v2):

Description

A client is allowed to set as many xattrs in an inode as it wants, as long as it has CAP_XATTR_EXCL. This will allow him to buffer the xattrs and send them to the MDS later on. This will eventually result in crashing the MDS (and possibly also requires recovering the filesystem?).

There was an attempt long time ago to fix this in https://tracker.ceph.com/issues/19033, which resulted in commit eb915d0eeccb ("cephfs: fix write_buf's _len overflow problem"). This fix added a maximum size for the xattrs (keys + values). But this maximum is only enforced when a client uses the synchronous MDS_OP_SETXATTR operation.

Here's a small test case:

# dd if=/dev/zero bs=1 count=65536 2> /dev/null | attr -s myattr /mnt/myfile
attr_set: No space left on device
Could not set "myattr" for /mnt/myfile
# dd if=/dev/zero bs=1 count=65536 2> /dev/null | attr -s myattr /mnt/myfile
Attribute "myattr" set to a 65536 byte value for /mnt/myfile:

#

Related issues 5 (1 open4 closed)

Copied to CephFS - Backport #59034: quincy: MDS allows a (kernel) client to exceed the xattrs key/value limitsDuplicateLuis HenriquesActions
Copied to CephFS - Backport #59035: pacific: MDS allows a (kernel) client to exceed the xattrs key/value limitsRejectedRishabh DaveActions
Copied to CephFS - Backport #59036: pacific: MDS allows a (kernel) client to exceed the xattrs key/value limitsDuplicateLuis HenriquesActions
Copied to CephFS - Backport #59037: quincy: MDS allows a (kernel) client to exceed the xattrs key/value limitsIn ProgressRishabh DaveActions
Copied to CephFS - Backport #59405: reef: MDS allows a (kernel) client to exceed the xattrs key/value limitsResolvedMykola GolubActions
Actions #1

Updated by Luis Henriques almost 2 years ago

I've created https://github.com/ceph/ceph/pull/46357 that's still an RFC as I'm not sure that's the way to go. I'll also sent a kernel patch that tries to mitigate the issue: https://lore.kernel.org/ceph-devel/20220520115426.438-1-lhenriques@suse.de/

Actions #2

Updated by Venky Shankar almost 2 years ago

  • Status changed from New to Fix Under Review
  • Assignee set to Luis Henriques
  • Target version set to v18.0.0
  • Backport set to quincy, pacific
  • Severity changed from 3 - minor to 2 - major
  • Pull request ID set to 46357
Actions #3

Updated by Venky Shankar about 1 year ago

  • Status changed from Fix Under Review to Pending Backport
Actions #4

Updated by Backport Bot about 1 year ago

  • Copied to Backport #59034: quincy: MDS allows a (kernel) client to exceed the xattrs key/value limits added
Actions #5

Updated by Backport Bot about 1 year ago

  • Copied to Backport #59035: pacific: MDS allows a (kernel) client to exceed the xattrs key/value limits added
Actions #6

Updated by Backport Bot about 1 year ago

  • Copied to Backport #59036: pacific: MDS allows a (kernel) client to exceed the xattrs key/value limits added
Actions #7

Updated by Backport Bot about 1 year ago

  • Copied to Backport #59037: quincy: MDS allows a (kernel) client to exceed the xattrs key/value limits added
Actions #8

Updated by Backport Bot about 1 year ago

  • Tags set to backport_processed
Actions #9

Updated by Venky Shankar about 1 year ago

  • Backport changed from quincy, pacific to reef,quincy,pacific
Actions #10

Updated by Venky Shankar about 1 year ago

  • Tags deleted (backport_processed)
Actions #11

Updated by Backport Bot about 1 year ago

  • Copied to Backport #59405: reef: MDS allows a (kernel) client to exceed the xattrs key/value limits added
Actions #12

Updated by Backport Bot about 1 year ago

  • Tags set to backport_processed
Actions #13

Updated by Patrick Donnelly 2 months ago

  • Target version changed from v18.0.0 to v19.1.0
Actions

Also available in: Atom PDF