148 lines
4.4 KiB
Diff
148 lines
4.4 KiB
Diff
From 2e58ff6978f8433fc8672d2e357c6f0f5f36d24f Mon Sep 17 00:00:00 2001
|
|
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
|
|
Date: Mon, 27 Jan 2020 19:02:07 +0100
|
|
Subject: [PATCH 096/116] virtiofsd: prevent races with lo_dirp_put()
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
Message-id: <20200127190227.40942-93-dgilbert@redhat.com>
|
|
Patchwork-id: 93546
|
|
O-Subject: [RHEL-AV-8.2 qemu-kvm PATCH 092/112] virtiofsd: prevent races with lo_dirp_put()
|
|
Bugzilla: 1694164
|
|
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
|
|
|
|
From: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
|
Introduce lo_dirp_put() so that FUSE_RELEASEDIR does not cause
|
|
use-after-free races with other threads that are accessing lo_dirp.
|
|
|
|
Also make lo_releasedir() atomic to prevent FUSE_RELEASEDIR racing with
|
|
itself. This prevents double-frees.
|
|
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
(cherry picked from commit acefdde73b403576a241ebd8dbe8431ddc0d9442)
|
|
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
---
|
|
tools/virtiofsd/passthrough_ll.c | 41 ++++++++++++++++++++++++++++++++++------
|
|
1 file changed, 35 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
|
|
index 690edbc..2d703b5 100644
|
|
--- a/tools/virtiofsd/passthrough_ll.c
|
|
+++ b/tools/virtiofsd/passthrough_ll.c
|
|
@@ -1284,11 +1284,28 @@ static void lo_readlink(fuse_req_t req, fuse_ino_t ino)
|
|
}
|
|
|
|
struct lo_dirp {
|
|
+ gint refcount;
|
|
DIR *dp;
|
|
struct dirent *entry;
|
|
off_t offset;
|
|
};
|
|
|
|
+static void lo_dirp_put(struct lo_dirp **dp)
|
|
+{
|
|
+ struct lo_dirp *d = *dp;
|
|
+
|
|
+ if (!d) {
|
|
+ return;
|
|
+ }
|
|
+ *dp = NULL;
|
|
+
|
|
+ if (g_atomic_int_dec_and_test(&d->refcount)) {
|
|
+ closedir(d->dp);
|
|
+ free(d);
|
|
+ }
|
|
+}
|
|
+
|
|
+/* Call lo_dirp_put() on the return value when no longer needed */
|
|
static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
|
|
{
|
|
struct lo_data *lo = lo_data(req);
|
|
@@ -1296,6 +1313,9 @@ static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
|
|
|
|
pthread_mutex_lock(&lo->mutex);
|
|
elem = lo_map_get(&lo->dirp_map, fi->fh);
|
|
+ if (elem) {
|
|
+ g_atomic_int_inc(&elem->dirp->refcount);
|
|
+ }
|
|
pthread_mutex_unlock(&lo->mutex);
|
|
if (!elem) {
|
|
return NULL;
|
|
@@ -1331,6 +1351,7 @@ static void lo_opendir(fuse_req_t req, fuse_ino_t ino,
|
|
d->offset = 0;
|
|
d->entry = NULL;
|
|
|
|
+ g_atomic_int_set(&d->refcount, 1); /* paired with lo_releasedir() */
|
|
pthread_mutex_lock(&lo->mutex);
|
|
fh = lo_add_dirp_mapping(req, d);
|
|
pthread_mutex_unlock(&lo->mutex);
|
|
@@ -1364,7 +1385,7 @@ static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
|
|
off_t offset, struct fuse_file_info *fi, int plus)
|
|
{
|
|
struct lo_data *lo = lo_data(req);
|
|
- struct lo_dirp *d;
|
|
+ struct lo_dirp *d = NULL;
|
|
struct lo_inode *dinode;
|
|
char *buf = NULL;
|
|
char *p;
|
|
@@ -1454,6 +1475,8 @@ static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
|
|
|
|
err = 0;
|
|
error:
|
|
+ lo_dirp_put(&d);
|
|
+
|
|
/*
|
|
* If there's an error, we can only signal it if we haven't stored
|
|
* any entries yet - otherwise we'd end up with wrong lookup
|
|
@@ -1484,22 +1507,25 @@ static void lo_releasedir(fuse_req_t req, fuse_ino_t ino,
|
|
struct fuse_file_info *fi)
|
|
{
|
|
struct lo_data *lo = lo_data(req);
|
|
+ struct lo_map_elem *elem;
|
|
struct lo_dirp *d;
|
|
|
|
(void)ino;
|
|
|
|
- d = lo_dirp(req, fi);
|
|
- if (!d) {
|
|
+ pthread_mutex_lock(&lo->mutex);
|
|
+ elem = lo_map_get(&lo->dirp_map, fi->fh);
|
|
+ if (!elem) {
|
|
+ pthread_mutex_unlock(&lo->mutex);
|
|
fuse_reply_err(req, EBADF);
|
|
return;
|
|
}
|
|
|
|
- pthread_mutex_lock(&lo->mutex);
|
|
+ d = elem->dirp;
|
|
lo_map_remove(&lo->dirp_map, fi->fh);
|
|
pthread_mutex_unlock(&lo->mutex);
|
|
|
|
- closedir(d->dp);
|
|
- free(d);
|
|
+ lo_dirp_put(&d); /* paired with lo_opendir() */
|
|
+
|
|
fuse_reply_err(req, 0);
|
|
}
|
|
|
|
@@ -1710,6 +1736,9 @@ static void lo_fsyncdir(fuse_req_t req, fuse_ino_t ino, int datasync,
|
|
} else {
|
|
res = fsync(fd);
|
|
}
|
|
+
|
|
+ lo_dirp_put(&d);
|
|
+
|
|
fuse_reply_err(req, res == -1 ? errno : 0);
|
|
}
|
|
|
|
--
|
|
1.8.3.1
|
|
|