On 4/12/23 21:38, Donald Buczek wrote: > Subject: > Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module > From: > Donald Buczek <buczek@xxxxxxxxxxxxx> > Date: > 4/12/23, 21:38 > > To: > Sergei Shtepa <sergei.shtepa@xxxxxxxxx>, axboe@xxxxxxxxx, hch@xxxxxxxxxxxxx, corbet@xxxxxxx, snitzer@xxxxxxxxxx > CC: > viro@xxxxxxxxxxxxxxxxxx, brauner@xxxxxxxxxx, willy@xxxxxxxxxxxxx, kch@xxxxxxxxxx, martin.petersen@xxxxxxxxxx, vkoul@xxxxxxxxxx, ming.lei@xxxxxxxxxx, gregkh@xxxxxxxxxxxxxxxxxxx, linux-block@xxxxxxxxxxxxxxx, linux-doc@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx > > > I think, you can trigger all kind of user-after-free when userspace deletes a snapshot image or the snapshot image and the tracker while the disk device snapshot image is kept alive (mounted or just opened) and doing I/O. > > Here is what I did to provoke that: > > root@dose:~# s=$(blksnap snapshot_create -d /dev/vdb) > root@dose:~# blksnap snapshot_appendstorage -i $s -f /scratch/local/test.dat > device path: '/dev/block/253:2' > allocate range: ofs=11264624 cnt=2097152 > root@dose:~# blksnap snapshot_take -i $s > root@dose:~# mount /dev/blksnap-image_253\:16 /mnt > root@dose:~# dd if=/dev/zero of=/mnt/x.x & > [1] 2514 > root@dose:~# blksnap snapshot_destroy -i $s > dd: writing to '/mnt/x.x': No space left on device > 1996041+0 records in > 1996040+0 records out > 1021972480 bytes (1.0 GB, 975 MiB) copied, 8.48923 s, 120 MB/s > [1]+ Exit 1 dd if=/dev/zero of=/mnt/x.x > Thanks! I am very glad that the blksnap tool turned out to be useful in the review. This snapshot deletion scenario is not the most typical, but of course it is quite possible. I will need to solve this problem and add such a scenario to the test suite.
