NetBSD Problem Report #58146

From rhialto@falu.nl  Fri Apr 12 19:30:43 2024
Return-Path: <rhialto@falu.nl>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 690D41A9239
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 12 Apr 2024 19:30:43 +0000 (UTC)
Message-Id: <ZhmL3XjUpENMTnCX@falu.nl>
Date: Fri, 12 Apr 2024 21:30:37 +0200
From: Rhialto <rhialto@falu.nl>
Reply-To: Rhialto <rhialto@falu.nl>
To: gnats-bugs@NetBSD.org
Cc: Rhialto <rhialto@falu.nl>
Subject: msdosfs crash on rename
X-Send-Pr-Version: 3.95

>Number:         58146
>Category:       kern
>Synopsis:       msdosfs crashes when renaming a file
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Apr 12 19:35:00 +0000 2024
>Closed-Date:    Thu Jun 20 20:11:33 +0000 2024
>Last-Modified:  Thu Jun 20 20:11:33 +0000 2024
>Originator:     Rhialto
>Release:        NetBSD 10.0
>Organization:
>Environment:
System: NetBSD murthe.falu.nl 10.0 NetBSD 10.0 (GENERIC) #0: Thu Mar 28 08:33:33 UTC 2024 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:
	I was doing a backup with rsync, and while doing my /mnt/efi
	partition of type msdos, to its copy on the backup disk, also
	type msdos, the receiving file system crashed.

	Fortunately it was mounted with -o rump so the real kernel had
	no problems.

>How-To-Repeat:
	mount -t msdos -o rump NAME=efi /mnt2/backup/mnt/efi

	df showed for original and backup:

	Filesystem   1K-blocks Used Avail  %Cap Mounted on
	/dev/dk3     130924    1168 129756   0% /mnt/efi
	/dev/dk14    0         0    0      100% /mnt2/backup/mnt/efi

	Rather suspicious values for the backup...
	/mnt/efi was mounted without -o rump.

	Output from rsync:

	$ rsync -avD $delete --hard-links --sparse --one-file-system \
	-i --info=progress2,stats2,symsafe \
	"$@" \
	${dir}/ ${mountpoint}${dir}

	[   1.0000000] entropy: ready
	Copying /mnt/efi...
	sending incremental file list
	.d..t...... efi/
		      0   0%    0.00kB/s    0:00:00 (xfr#0, to-chk=3/7)
	.d..t...... efi/boot/
	>f..t...... efi/boot/bootx64.efi
		223,912  19%   26.04MB/s    0:00:00 (xfr#1, to-chk=1/7)
	>f..t...... efi/boot/shell.efi
	[   1.2900050] panic: kernel diagnostic assertion "tcnp->cn_cred == cred" failed: file "/usr/src/sys/rump/fs/lib/libmsdos/../../../../fs/msdosfs/msdosfs_rename.c", line 130 
	[   1.2900050] rump kernel halting...
	halted
	rsync: [receiver] rename "/mnt2/backup/mnt/efi/efi/boot/.bootx64.efi.fGR0Eg" -> "efi/boot/bootx64.efi": Device not configured (6)
	rsync: [receiver] mkstemp "/mnt2/backup/mnt/efi/efi/boot/.shell.efi.v6vujP" failed: No such file or directory (2)
	      1,175,656  99%    5.05MB/s    0:00:00 (xfr#2, to-chk=1/7)
	.d..t...... efi/netbsd/
	>f..t...... efi/netbsd/boot.cfg
	      1,176,137 100%    5.05MB/s    0:00:00 (xfr#3, to-chk=0/7)rsync: [receiver] mkstemp "/mnt2/backup/mnt/efi/efi/netbsd/.boot.cfg.HeG2sg" failed: No such file or directory (2)
	      1,176,137 100%    5.05MB/s    0:00:00 (xfr#3, to-chk=0/7)

	Number of files: 7 (reg: 3, dir: 4)
	Number of created files: 0
	Number of deleted files: 0
	Number of regular files transferred: 3
	Total file size: 1,176,137 bytes
	Total transferred file size: 1,176,137 bytes
	Literal data: 1,176,137 bytes
	Matched data: 0 bytes
	File list size: 0
	File list generation time: 0.001 seconds
	File list transfer time: 0.000 seconds
	Total bytes sent: 1,176,746
	Total bytes received: 84

	sent 1,176,746 bytes  received 84 bytes  784,553.33 bytes/sec
	total size is 1,176,137  speedup is 1.00
	rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1336) [sender=3.2.7]

	I didn't try it with a non-rump msdosfs. Maybe it would not
	crash because DIAGNOSTIC is not enabled in GENERIC. But that the
	assertion fails may lead to other problems later.

>Fix:
	Not yet known.
	I can provide a dump of the file system in question if that
	might be needed.

>Release-Note:

>Audit-Trail:
From: Rhialto <rhialto@falu.nl>
To: gnats-bugs@NetBSD.org
Cc: Rhialto <rhialto@falu.nl>
Subject: Re: kern/58146: msdosfs crash on rename
Date: Fri, 3 May 2024 11:45:47 +0200

 mlelstv@ observed:

 Maybe that's rump.

 msdosfs:
         KASSERT(tcnp->cn_cred == cred);

 genfs:  /*
          * XXX Want a better equality test.  `tcnp->cn_cred == cred'
          * hoses p2k because puffs transmits the creds separately and
          * allocates distinct but equivalent structures for them.
          */
         KASSERT(kauth_cred_uidmatch(cred, tcnp->cn_cred));


 When I replaced the KASSERT in usr/src/sys/fs/msdosfs/msdosfs_rename.c and
 tested it (correctly) this indeed fixed the problem.

From: Rhialto <rhialto@falu.nl>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org,
	netbsd-bugs@netbsd.org, Rhialto <rhialto@falu.nl>
Subject: Re: kern/58146: msdosfs crash on rename
Date: Mon, 20 May 2024 13:31:51 +0200

 I propose to commit this and request pullup to 10.
 I copied the comment to be in line with genfs_rename.c.

 Index: fs/msdosfs/msdosfs_rename.c
 ===================================================================
 RCS file: /cvsroot/src/sys/fs/msdosfs/msdosfs_rename.c,v
 retrieving revision 1.3
 diff -u -r1.3 msdosfs_rename.c
 --- fs/msdosfs/msdosfs_rename.c	23 Oct 2021 16:58:17 -0000	1.3
 +++ fs/msdosfs/msdosfs_rename.c	20 May 2024 11:30:26 -0000
 @@ -127,7 +127,13 @@
  	KASSERT(tdvp->v_type == VDIR);

  	cred = fcnp->cn_cred;
 -	KASSERT(tcnp->cn_cred == cred);
 +
 +	/*
 +	 * XXX Want a better equality test.  `tcnp->cn_cred == cred'
 +	 * hoses p2k because puffs transmits the creds separately and
 +	 * allocates distinct but equivalent structures for them.
 +	 */
 +	KASSERT(kauth_cred_uidmatch(cred, tcnp->cn_cred));

  	/*
  	 * Sanitize our world from the VFS insanity.  Unlock the target

State-Changed-From-To: open->closed
State-Changed-By: rhialto@NetBSD.org
State-Changed-When: Thu, 20 Jun 2024 20:11:33 +0000
State-Changed-Why:
fix pulled up to 10 [pullup-10 #706]


>Unformatted:

Home	PR Database Search