Re: Race in open(O_CREAT|O_EXCL) and network filesystem

[Neil Brown]

On Sunday July 28, [e-mail] wrote:
> Hi all,
> 
> maybe I'm blind, but I think there is a race featuring
> open(O_CREAT|O_EXCL) and nfs or any other network fs.
> 
> What may happen is:
> 
> client A: open_namei looks up the inode
> 	driver queries server and gets ENOENT
> client B: open_namei looks up the inode
> 	driver queries server and gets ENOENT
> client A: open_namei calls create method
> 	driver requests file to be created and is successful
> client B: open_namei calls create method
> 	dirver requests file to be created and since it does not know,
> 	cant specify exclusion, thus is succesful
> client A: open_namei does no more checks and thus open succeeds
> client B: open succeeds too here - and it shouldn't
> 
> Since many applications rely on this working correctly (especialy
> mailboxes are locked using exclusive creates and mounting them over NFS
> is quite common).
> 
> So, can someone please answer:
> 
> 1) Is there some reason this can't happen that I overlooked?

No.  You are correct.

> 2) If it is a problem (comment in NFS suggest so), I can see two ways of
> handling this. Either pass the flags to the create method, or restart
> the open when create returns EEXISTS. Which one would be prefered?

Well.. at OLS in the Lustre talk Peter Braam talked about something
that could be used.  Unfortunately it doesn't seem to be included in
the paper in the proceedings but the idea was to include some "intend"
in the lookup request.  e.g. "lookup with intent to create" or
"lookup with intent to delete" or maybe "lookup with intent to open
for exclusive write access".  The filesystem could then, at it's
option, carry out the intended operation (possibly only partially) as
part of the lookup.  A simple filesystem wouldn't bothe and the VFS
would continue with the normal process. A networked filesystem could
do that whole operation including intent atomically.

Apparently Al Viro is not completely against the idea, but I haven't
actually seen any code or detailed specs (not that I have looked hard)
so it might all be vapourware.

> 3) How to fix NFS to add exclude flag to the NFSv3 request?

It's not easy... else it would already have been done.

NeilBrown