std::fs::Metadata timestamp methods will panic on files with invalid timestamp nsec values

[felinira]

std::fs::Metadata timestamp methods (like created) will panic on files with invalid timestamp nsec values.`

It will panic here:
thread 'async-std/runtime' panicked at 'assertion failed: tv_nsec >= 0 && tv_nsec < NSEC_PER_SEC as i64', library/std/src/sys/unix/time.rs:66:9

We have recently stumbled upon multiple btrfs users that happen to have files that look something like this:

# stat ./.temp-FOYNU1
File: ./.temp-FOYNU1
Size: 37271     	Blocks: 80         IO Block: 4096   regular file
Device: 0,40	Inode: 4024244     Links: 1
Access: (0600/-rw-------)  Uid: ( 1000/   x)   Gid: ( 1000/   x)
Context: unconfined_u:object_r:gkeyringd_gnome_home_t:s0
Access: 2023-02-19 21:35:19.087361106 +0100
Modify: 2022-10-29 09:48:58.344737238 +0200
Change: 2022-10-29 09:48:58.344737238 +0200
Birth: 5006491383123099853.-1424152917

This is most likely a filesystem / kernel bug. But these files / broken kernels exist now and will cause any access to ctime (and possible the other time values) to panic.

My proposal would be to check bounds of the underlying syscall results and return an appropriate Err for these broken time values if the ctime / mtime / atime etc. contains values that would otherwise trigger this assertion.

Meta

rustc --version --verbose:

rustc 1.67.1 (d5a82bbd2 2023-02-07)
binary: rustc
commit-hash: d5a82bbd26e1ad8b7401f6a718a9c57c96905483
commit-date: 2023-02-07
host: x86_64-unknown-linux-gnu
release: 1.67.1
LLVM version: 15.0.6

Backtrace

   0:     0x556e2422048a - std::backtrace_rs::backtrace::libunwind::trace::h79937bc171ada62c
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5
   1:     0x556e2422048a - std::backtrace_rs::backtrace::trace_unsynchronized::h2292bca8571cb919
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x556e2422048a - std::sys_common::backtrace::_print_fmt::h9c461f248e4ae90d
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/sys_common/backtrace.rs:65:5
   3:     0x556e2422048a - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::he9fe6bf1a39182e1
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x556e2424687e - core::fmt::write::h032658c119c720d7
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/core/src/fmt/mod.rs:1208:17
   5:     0x556e24219c65 - std::io::Write::write_fmt::h299fc90dfae41c0d
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/io/mod.rs:1682:15
   6:     0x556e24220255 - std::sys_common::backtrace::_print::heb70d25df9937e3f
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/sys_common/backtrace.rs:47:5
   7:     0x556e24220255 - std::sys_common::backtrace::print::had745c0a76b8b521
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/sys_common/backtrace.rs:34:9
   8:     0x556e24221cff - std::panicking::default_hook::{{closure}}::h1ea782cdfa2fd097
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/panicking.rs:267:22
   9:     0x556e24221a3b - std::panicking::default_hook::h1cc3af63455a163c
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/panicking.rs:286:9
  10:     0x556e2422240c - std::panicking::rust_panic_with_hook::h5cafdc4b3bfd5528
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/panicking.rs:688:13
  11:     0x556e24222162 - std::panicking::begin_panic_handler::{{closure}}::hf31c60f40775892c
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/panicking.rs:577:13
  12:     0x556e2422093c - std::sys_common::backtrace::__rust_end_short_backtrace::h28a5c7be595826cd
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/sys_common/backtrace.rs:137:18
  13:     0x556e24221eb2 - rust_begin_unwind
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/panicking.rs:575:5
  14:     0x556e237c2243 - core::panicking::panic_fmt::h8fa27a0b37dd98b7
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/core/src/panicking.rs:64:14
  15:     0x556e237c231d - core::panicking::panic::h545818946343732b
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/core/src/panicking.rs:111:5
  16:     0x556e2421704d - std::sys::unix::time::Timespec::new::h0e233601cbadebfd
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/sys/unix/time.rs:66:9
  17:     0x556e2421704d - std::sys::unix::time::SystemTime::new::h9d5242895ff4c7e2
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/sys/unix/time.rs:29:25
  18:     0x556e2421704d - std::sys::unix::fs::FileAttr::created::hb18250e52af180d4
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/sys/unix/fs.rs:485:24
  19:     0x556e2421704d - std::fs::Metadata::created::h80fcc7cb446092ab
                               at /rustc/d5a82bbd26e1ad8b7401f6a718a9c57c96905483/library/std/src/fs.rs:1311:9

[ChancellorCeti]

@rustbot claim

[Stargateur]

My proposal would be to check bounds of the underlying syscall results and return None for these broken time values if the ctime / mtime / atime etc. contains values that would otherwise trigger this assertion.

You mean that created return Err ? I agree, this shouldn't panic.

[felinira]

You mean that created return Err

Ah yeah right, this is a Result not Option

[bblacher]

Any news on this?

[llagerlof]

This should be a priority. Programs written in Rust simply crash without this fix.

[Stargateur]

I will see what I can do

@rustbot claim