On Sun, 06 Nov 2011 18:15:01 -0300, Davidlohr Bueso said:
> @@ -1159,7 +1159,12 @@ shmem_write_begin(struct file *file, struct address_space *mapping,
> struct page **pagep, void **fsdata)
> + if (atomic_long_read(&user->shmem_bytes) + len >
> + rlimit(RLIMIT_TMPFSQUOTA))
> + return -ENOSPC;
Is this a per-process or per-user limit? If it's per-process, it doesn't
really do much good, because a user can use multiple processes to over-run the
limit (either intentionally or accidentally).
> @@ -1169,10 +1174,12 @@ shmem_write_end(struct file *file, struct address_space *mapping,
> struct page *page, void *fsdata)
> + if (pos + copied > inode->i_size) {
> i_size_write(inode, pos + copied);
> + atomic_long_add(copied, &user->shmem_bytes);
> + }
If this is per-user, it's racy with shmem_write_begin() - two processes can hit
the write_begin(), be under quota by (say) 1M, but by the time they both
complete the user is 1M over the quota.
> @@ -1535,12 +1542,15 @@ static int shmem_unlink(struct inode *dir, struct dentry *dentry)
> + struct user_struct *user = current_user();
> + atomic_long_sub(inode->i_size, &user->shmem_bytes);
What happens here if user 'fred' creates a file on a tmpfs, and then logs out so he has
no processes running, and then root does a 'find tmpfs -user fred -exec rm {} \;' to clean up?
We just decremented root's quota, not fred's....
Attachment:
pgp66ORkB7iVV.pgp
Description: PGP signature