vfs: Add timestamp range check support
Subsystems (3)
v4 cover vfs: Add timestamp range check support
The series is aimed at adding timestamp checking and policy related to it to vfs.
The series was developed with discussions and guidance from Arnd Bergmann.
The original thread is at https://lkml.org/lkml/2016/11/2/294
Associated test: xfstests generic/402
Note that the above test will be run and will fail all filesystems that do not have correct limits specified in the xfstests or the kernel or that don't support times beyond the test dates. I will be submitting a follow up xfstest and kernel patches to update all filesystems. Currently ext4 is the only filesystem that reflects correct limits.
The branch is available at
https://github.com/deepa-hub/vfs.git refs/heads/vfs_timestamp_policy
Changes since v3:
* Remove redundant initializations in libfs.c
* Change early_param to __setup similar to other root mount options.
* Fix documentation warning
Changes since v2:
* Introduce early boot param override for checks.
* Drop afs patch for timestamp limits.
Changes since v1:
* return EROFS on mount errors
* fix mtime copy/paste error in utimes
Deepa Dinamani (5):
vfs: Add file timestamp range support
vfs: Add checks for filesystem timestamp limits
ext4: Initialize timestamps limits
vfs: Add timestamp_truncate() api
utimes: Clamp the timestamps before update
fs/ext4/ext4.h | 4 ++++ fs/ext4/super.c | 7 ++++++- fs/inode.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++- fs/internal.h | 2 ++ fs/namespace.c | 12 ++++++++++++ fs/super.c | 9 +++++++++ fs/utimes.c | 17 +++++++++++++---- include/linux/fs.h | 4 ++++ include/linux/time64.h | 6 ++++++ include/uapi/linux/fs.h | 6 +++++- kernel/sysctl.c | 7 +++++++ 11 files changed, 114 insertions(+), 7 deletions(-)
Signature · 6 lines
2.7.4 _______________________________________________ Y2038 mailing list [email protected] https://lists.linaro.org/mailman/listinfo/y2038
PATCH v4 1/5 vfs: Add file timestamp range support
Add fields to the superblock to track the min and max timestamps supported by filesystems.
Initially, when a superblock is allocated, initialize it to the max and min values the fields can hold. Individual filesystems override these to match their actual limits.
Pseudo filesystems are assumed to always support the min and max allowable values for the fields.
Note that the time ranges are saved in type time64_t rather than time_t.
This is required because if we save ranges in time_t then we would not be able to save timestamp ranges for files that support timestamps beyond y2038.
--- fs/super.c | 2 ++ include/linux/fs.h | 3 +++ include/linux/time64.h | 2 ++ 3 files changed, 7 insertions(+)
fs/super.c +2 -0
@@ -247,6 +247,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags, s->s_maxbytes =MAX_NON_LFS ; s->s_op = &default_op; s->s_time_gran =1000000000 ; + s->s_time_min =TIME64_MIN ; + s->s_time_max =TIME64_MAX ; s->cleancache_poolid =CLEANCACHE_NO_POOL ; s->s_shrink.seeks =DEFAULT_SEEKS ;
include/linux/fs.h +3 -0
@@ -1337,6 +1337,9 @@ struct super_block {/* Granularity of c/m/atime in ns. Cannot be worse than a second */ u32 s_time_gran; +/* Time limits for c/m/atime in seconds. */ +time64_t s_time_min; +time64_t s_time_max;/* * The next field is for VFS *only*. No filesystems have any business
include/linux/time64.h +2 -0
@@ -38,6 +38,8 @@ struct itimerspec64 {/* Located here for timespec[64]_valid_strict */ #define TIME64_MAX ((s64)~((u64)1 << 63)) +#define TIME64_MIN (-TIME64_MAX - 1) +#define KTIME_MAX ((s64)~((u64)1 << 63))#define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
Signature · 6 lines
2.7.4 _______________________________________________ Y2038 mailing list [email protected] https://lists.linaro.org/mailman/listinfo/y2038
PATCH v4 2/5 vfs: Add checks for filesystem timestamp limits
In reply to Deepa DinamaniAllow read only mounts for filesystems that do not have maximum timestamps beyond the y2038 expiry timestamp.
Also, allow a sysctl override to all such filesystems to be mounted with write permissions.
A boot param supports initial override of these checks from the early boot without recompilation.
--- fs/inode.c | 15 +++++++++++++++ fs/internal.h | 2 ++ fs/namespace.c | 12 ++++++++++++ fs/super.c | 7 +++++++ include/linux/fs.h | 1 + include/linux/time64.h | 4 ++++ include/uapi/linux/fs.h | 6 +++++- kernel/sysctl.c | 7 +++++++ 8 files changed, 53 insertions(+), 1 deletion(-)
fs/inode.c +15 -0
@@ -75,6 +75,21 @@ static DEFINE_PER_CPU(unsigned long, nr_unused);static struct kmem_cache *inode_cachep__read_mostly ; +struct vfs_max_timestamp_check timestamp_check = { + .timestamp_supported =Y2038_EXPIRY_TIMESTAMP , + .check_on =0 , +}; + +static int __init setup_timestamp_check (char *str) +{ +if (*str) +return 0 ; + timestamp_check.check_on =1 ; +return 1 ; +} + +__setup ("fstimestampcheck" , setup_timestamp_check); +static long get_nr_inodes (void ) {int i;
fs/internal.h +2 -0
@@ -67,6 +67,8 @@ extern int finish_automount(struct vfsmount *, struct path *);extern int sb_prepare_remount_readonly (struct super_block *); +extern bool sb_file_times_updatable (struct super_block *sb); +extern void __init mnt_init (void );extern int __mnt_want_write (struct vfsmount *);
fs/namespace.c +12 -0
@@ -538,6 +538,18 @@ static void __mnt_unmake_readonly(struct mount *mnt)unlock_mount_hash (); } +bool sb_file_times_updatable (struct super_block *sb) +{ + +if (!timestamp_check.check_on) +return true; + +if (sb->s_time_max > timestamp_check.timestamp_supported) +return true; + +return false; +} +int sb_prepare_remount_readonly (struct super_block *sb) {struct mount *mnt;
fs/super.c +7 -0
@@ -1245,6 +1245,13 @@ mount_fs(struct file_system_type *type, int flags, const char *name, void *data)WARN ((sb->s_maxbytes <0 ),"%s set sb->s_maxbytes to " "negative value (%lld)\n" , type->name, sb->s_maxbytes); +if (!(sb->s_flags &MS_RDONLY ) && !sb_file_times_updatable (sb)) { +WARN (1 ,"File times cannot be updated on the filesystem.\n" ); +WARN (1 ,"Retry mounting the filesystem readonly.\n" ); + error = -EROFS ; + goto out_sb; + } +up_write (&sb->s_umount);free_secdata (secdata);return root;
include/linux/fs.h +1 -0
@@ -68,6 +68,7 @@ extern struct inodes_stat_t inodes_stat;extern int leases_enable, lease_break_time;extern int sysctl_protected_symlinks;extern int sysctl_protected_hardlinks; +extern struct vfs_max_timestamp_check timestamp_check;struct buffer_head ; typedef int (get_block_t)(struct inode *inode, sector_t iblock,
include/linux/time64.h +4 -0
@@ -43,6 +43,10 @@ struct itimerspec64 {#define KTIME_MAX ((s64)~((u64)1 << 63))#define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC) +/* Timestamps on boundary */ +#define Y2038_EXPIRY_TIMESTAMP S32_MAX/* 2147483647 */ +#define Y2106_EXPIRY_TIMESTAMP U32_MAX/* 4294967295 */ +#if __BITS_PER_LONG ==64 static inline struct timespec timespec64_to_timespec (const struct timespec64 ts64)
include/uapi/linux/fs.h +5 -1
@@ -91,6 +91,11 @@ struct files_stat_struct {unsigned long max_files;/* tunable */ }; +struct vfs_max_timestamp_check { +time64_t timestamp_supported; +int check_on; +}; +struct inodes_stat_t {long nr_inodes;long nr_unused;
@@ -100,7 +105,6 @@ struct inodes_stat_t {#define NR_FILE 8192/* this can well be larger on a larger system */ -/* * These are the fs-independent mount-flags: up to 32 flags are supported */
kernel/sysctl.c +7 -0
@@ -1667,6 +1667,13 @@ static struct ctl_table fs_table[] = { .proc_handler = proc_doulongvec_minmax, }, { + .procname = "fs-timestamp-check-on", + .data = ×tamp_check.check_on, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec, + }, + { .procname = "nr_open", .data = &sysctl_nr_open, .maxlen = sizeof(unsigned int),
Signature · 6 lines
2.7.4 _______________________________________________ Y2038 mailing list [email protected] https://lists.linaro.org/mailman/listinfo/y2038
PATCH v4 3/5 ext4: Initialize timestamps limits
In reply to Deepa Dinamaniext4 has different overflow limits for max filesystem timestamps based on the extra bytes available.
--- fs/ext4/ext4.h | 4 ++++ fs/ext4/super.c | 7 ++++++- 2 files changed, 10 insertions(+), 1 deletion(-)
fs/ext4/ext4.h +4 -0
@@ -1639,6 +1639,10 @@ static inline void ext4_clear_state_flags(struct ext4_inode_info *ei)#define EXT4_GOOD_OLD_INODE_SIZE 128 +#define EXT4_EXTRA_TIMESTAMP_MAX (((s64)1 << 34) - 1 + S32_MIN) +#define EXT4_NON_EXTRA_TIMESTAMP_MAX Y2038_EXPIRY_TIMESTAMP +#define EXT4_TIMESTAMP_MIN S32_MIN +/* * Feature set definitions */
fs/ext4/super.c +6 -1
@@ -3689,8 +3689,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) sbi->s_inode_size); goto failed_mount; } -if (sbi->s_inode_size >EXT4_GOOD_OLD_INODE_SIZE ) +if (sbi->s_inode_size >EXT4_GOOD_OLD_INODE_SIZE ) { sb->s_time_gran =1 << (EXT4_EPOCH_BITS -2 ); + sb->s_time_max =EXT4_EXTRA_TIMESTAMP_MAX ; + }else + sb->s_time_max =EXT4_NON_EXTRA_TIMESTAMP_MAX ; + + sb->s_time_min =EXT4_TIMESTAMP_MIN ; } sbi->s_desc_size =le16_to_cpu (es->s_desc_size);
Signature · 6 lines
2.7.4 _______________________________________________ Y2038 mailing list [email protected] https://lists.linaro.org/mailman/listinfo/y2038
PATCH v4 4/5 vfs: Add timestamp_truncate() api
In reply to Deepa Dinamanitimespec_trunc() function is used to truncate a filesystem timestamp to the right granularity. But, the function does not clamp tv_sec part of the timestamps according to the filesystem timestamp limits.
Also, timespec_trunc() is exclusively used for filesystem timestamps. Move the api to be part of vfs.
The replacement api: timestamp_truncate() also alters the signature of the function to accommodate filesystem timestamp clamping according to flesystem limits.
Note that the clamp_t macro is used for clamping here as vfs is not yet using struct timespec64 internally. This is required for compilation purposes.
Also note that clamp won't do the right thing for timestamps beyond 2038 on 32-bit machines until the vfs uses timespec64. After the vfs is transitioned to use timespec64 for timestamps, clamp_t() can be replaced by clamp().
--- fs/inode.c | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-)
fs/inode.c +31 -1
@@ -2116,6 +2116,36 @@ void inode_nohighmem(struct inode *inode)EXPORT_SYMBOL (inode_nohighmem);/** +* timestamp_truncate - Truncate timespec to a granularity +* @t: Timespec +* @inode: inode being updated +* +* Truncate a timespec to the granularity supported by the fs +* containing the inode. Always rounds down. gran must +* not be 0 nor greater than a second (NSEC_PER_SEC, or 10^9 ns). +*/ +struct timespec timestamp_truncate (struct timespec t,struct inode *inode) +{ +struct super_block *sb = inode->i_sb; +unsigned int gran = sb->s_time_gran; + + t.tv_sec =clamp_t (time64_t, t.tv_sec, sb->s_time_min, sb->s_time_max); + +/* Avoid division in the common cases 1 ns and 1 s. */ +if (gran ==1 ) { +/* nothing */ + }else if (gran ==NSEC_PER_SEC ) { + t.tv_nsec =0 ; + }else if (gran >1 && gran <NSEC_PER_SEC ) { + t.tv_nsec -= t.tv_nsec % gran; + }else { +WARN (1 ,"illegal file time granularity: %u" , gran); + } +return t; +} +EXPORT_SYMBOL (timestamp_truncate); + +/** * current_time - Return FS time * @inode: inode. *
@@ -2134,6 +2164,6 @@ struct timespec current_time(struct inode *inode)return now; } -return timespec_trunc (now, inode->i_sb->s_time_gran); +return timestamp_truncate (now, inode); }EXPORT_SYMBOL (current_time);
Signature · 6 lines
2.7.4 _______________________________________________ Y2038 mailing list [email protected] https://lists.linaro.org/mailman/listinfo/y2038
PATCH v4 5/5 utimes: Clamp the timestamps before update
In reply to Deepa DinamaniPOSIX.1 section for futimens, utimensat and utimes says:
The file's relevant timestamp shall be set to the greatest value supported by the file system that is not greater than the specified time.
Clamp the timestamps accordingly before assignment.
Note that the clamp_t macro is used for clamping here as vfs is not yet using struct timespec64 internally. This is required for compilation purposes.
Also note that clamp won't do the right thing for timestamps beyond 2038 on 32-bit machines until the vfs uses timespec64. After the vfs is transitioned to use timespec64 for timestamps, clamp_t() can be replaced by clamp().
--- fs/utimes.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
fs/utimes.c +13 -4
@@ -53,6 +53,7 @@ static int utimes_common(const struct path *path, struct timespec *times)int error;struct iattr newattrs;struct inode *inode = path->dentry->d_inode; +struct super_block *sb = inode->i_sb;struct inode *delegated_inode =NULL ; error =mnt_want_write (path->mnt);
@@ -68,16 +69,24 @@ static int utimes_common(const struct path *path, struct timespec *times)if (times[0 ].tv_nsec ==UTIME_OMIT ) newattrs.ia_valid &= ~ATTR_ATIME ;else if (times[0 ].tv_nsec !=UTIME_NOW ) { - newattrs.ia_atime.tv_sec = times[0 ].tv_sec; - newattrs.ia_atime.tv_nsec = times[0 ].tv_nsec; + newattrs.ia_atime.tv_sec = +clamp_t (time64_t, times[0 ].tv_sec, sb->s_time_min, sb->s_time_max); +if (times[0 ].tv_sec >= sb->s_time_max) + newattrs.ia_atime.tv_nsec =0 ; +else + newattrs.ia_atime.tv_nsec = times[0 ].tv_nsec; newattrs.ia_valid |=ATTR_ATIME_SET ; }if (times[1 ].tv_nsec ==UTIME_OMIT ) newattrs.ia_valid &= ~ATTR_MTIME ;else if (times[1 ].tv_nsec !=UTIME_NOW ) { - newattrs.ia_mtime.tv_sec = times[1 ].tv_sec; - newattrs.ia_mtime.tv_nsec = times[1 ].tv_nsec; + newattrs.ia_mtime.tv_sec = +clamp_t (time64_t, times[1 ].tv_sec, sb->s_time_min, sb->s_time_max); +if (times[1 ].tv_sec >= sb->s_time_max) + newattrs.ia_mtime.tv_nsec =0 ; +else + newattrs.ia_mtime.tv_nsec = times[1 ].tv_nsec; newattrs.ia_valid |=ATTR_MTIME_SET ; }/*
Signature · 6 lines
2.7.4 _______________________________________________ Y2038 mailing list [email protected] https://lists.linaro.org/mailman/listinfo/y2038
Re: [PATCH v4 1/5] vfs: Add file timestamp range support
In reply to Deepa DinamaniQuoted 29 lines · Deepa Dinamani
Add fields to the superblock to track the min and max timestamps supported by filesystems.
Initially, when a superblock is allocated, initialize it to the max and min values the fields can hold. Individual filesystems override these to match their actual limits.
Pseudo filesystems are assumed to always support the min and max allowable values for the fields.
Note that the time ranges are saved in type
time64_trather thantime_t.
This is required because if we save ranges intime_tthen we would not be able to save timestamp ranges for files that support timestamps beyond y2038.Signed-off-by Deepa Dinamani <[email protected]>--- fs/super.c | 2 ++ include/linux/fs.h | 3 +++ include/linux/time64.h | 2 ++ 3 files changed, 7 insertions(+)fs/super.c +0
-0
fs/super.c static struct super_block *alloc_super(struct file_system_type *type, int flags, · line 251
Quoted 5 lines
fs/super.c +2
-0@@ -247,6 +247,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags, s->s_maxbytes =MAX_NON_LFS ; s->s_op = &default_op; s->s_time_gran =1000000000 ; + s->s_time_min =TIME64_MIN ; + s->s_time_max =TIME64_MAX ;
Just out of curiosity, does this enable 64-bit timestamps for everything by default? I see that ext4 later sets its own values in fill_super; what about things like XFS that really only have 32-bit seconds fields?
--D
Quoted 33 lines
fs/super.c +0
-0s->cleancache_poolid =CLEANCACHE_NO_POOL ; s->s_shrink.seeks =DEFAULT_SEEKS ;include/linux/fs.h +3
-0@@ -1337,6 +1337,9 @@ struct super_block {/* Granularity of c/m/atime in ns. Cannot be worse than a second */ u32 s_time_gran; +/* Time limits for c/m/atime in seconds. */ +time64_t s_time_min; +time64_t s_time_max;/* * The next field is for VFS *only*. No filesystems have any business include/linux/time64.h +2
-0@@ -38,6 +38,8 @@ struct itimerspec64 {/* Located here for timespec[64]_valid_strict */ #define TIME64_MAX ((s64)~((u64)1 << 63)) +#define TIME64_MIN (-TIME64_MAX - 1) +#define KTIME_MAX ((s64)~((u64)1 << 63))#define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)Signature · 1 line
2.7.4
_______________________________________________
Y2038 mailing list
[email protected]
https://lists.linaro.org/mailman/listinfo/y2038
Re: [PATCH v4 1/5] vfs: Add file timestamp range support
Quoted 3 lines
Just out of curiosity, does this enable 64-bit timestamps for everything by default? I see that ext4 later sets its own values in
fill_super; what about things like XFS that really only have 32-bit seconds fields?
This is just initializing limits for each filesystem. Filesystems then override these limits with the actual limits they support. This is what ext4 patch in the series is doing.
As the cover letter says, I will be submitting patches for all filesystems to update limits.
This is no different than what is happening right now. Right now, on 64 bit systems, VFS assumes timestamps to be 64 bits long for all filesystems.
On 32 bit systems, the series only effects handling of dates beyond the year 2038.
This is until vfs is transitioned to support 64 bit times. At which point, the behavior on these will also be similar to 64 bit machines.
-Deepa
_______________________________________________
Y2038 mailing list
[email protected]
https://lists.linaro.org/mailman/listinfo/y2038