java-topology/whitepaper/outreach/juicefs-0001.md

JuiceFS — CWE-407 Disclosure Brief (juicefs-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(GN) defect in JuiceFS's ACL permission checking. The Rule.CanAccess() method in pkg/acl/acl.go uses a nested loop to check caller group IDs against named groups, producing O(GN) total cost where G = caller groups and N = named groups.

The Defect

juicefs-0001 (PATCHED — MEDIUM): pkg/acl/acl.go:232

for _, gid := range gids {
    for _, nGrp := range r.NamedGroups {  // O(N) per gid
        if gid == nGrp.Id {
            if uint8(nGrp.Perm&r.Mask&7)&mMask == mMask {
                return true
            }
            isGrpMatched = true
        }
    }
}

For each of G caller group IDs, the code scans all N named groups. This nested loop fires on every file access permission check.

Complexity Proof

At G=50 caller groups, N=100 named groups:

• Defective: 50 × 100 = 5,000 comparisons per access check
• Fixed: 50 (map build) + 100 (scan with O(1) lookup) = 150 operations
• ~33× op reduction.

Impact

JuiceFS is a distributed POSIX file system used in machine learning, big data, and cloud-native workloads. ACL permission checks fire on every file open, read, write, and stat operation. High-throughput workloads with many group memberships and complex ACL rules accumulate quadratic overhead on every I/O operation.

The Fix

Build a map[uint32]struct{} from caller gids once, then scan named groups with O(1) lookups:

// After
gidSet := make(map[uint32]struct{}, len(gids))
for _, gid := range gids { gidSet[gid] = struct{}{} }
for _, nGrp := range r.NamedGroups {
    if _, ok := gidSet[nGrp.Id]; ok { /* check permissions */ }
}

Patch

Fix available: defects/juicefs-0001/patch/juicefs-0001.patch

Single-file patch in pkg/acl/acl.go. ~33× speedup at 50 groups × 100 named groups.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (juicedata/juicefs).
2. Assess severity — fires on every file access permission check.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the JuiceFS team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.