yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-virtiofsd-passthrough_ll-add-lo_map-for-ino-fh-indir.patch

22c213
From d56651e227bae83ee0cceb12bd91e3e9f6045ab3 Mon Sep 17 00:00:00 2001
22c213
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
22c213
Date: Mon, 27 Jan 2020 19:01:13 +0100
22c213
Subject: [PATCH 042/116] virtiofsd: passthrough_ll: add lo_map for ino/fh
22c213
 indirection
22c213
MIME-Version: 1.0
22c213
Content-Type: text/plain; charset=UTF-8
22c213
Content-Transfer-Encoding: 8bit
22c213
22c213
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
22c213
Message-id: <20200127190227.40942-39-dgilbert@redhat.com>
22c213
Patchwork-id: 93492
22c213
O-Subject: [RHEL-AV-8.2 qemu-kvm PATCH 038/112] virtiofsd: passthrough_ll: add lo_map for ino/fh indirection
22c213
Bugzilla: 1694164
22c213
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
22c213
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
22c213
RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
22c213
22c213
From: Stefan Hajnoczi <stefanha@redhat.com>
22c213
22c213
A layer of indirection is needed because passthrough_ll cannot expose
22c213
pointers or file descriptor numbers to untrusted clients.  Malicious
22c213
clients could send invalid pointers or file descriptors in order to
22c213
crash or exploit the file system daemon.
22c213
22c213
lo_map provides an integer key->value mapping.  This will be used for
22c213
ino and fh fields in the patches that follow.
22c213
22c213
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
22c213
Reviewed-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
22c213
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
22c213
(cherry picked from commit 25c135727b08dca90f00094e522a69170b13dfac)
22c213
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
22c213
---
22c213
 tools/virtiofsd/passthrough_ll.c | 124 +++++++++++++++++++++++++++++++++++++++
22c213
 1 file changed, 124 insertions(+)
22c213
22c213
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
22c213
index 5e06179..e83a976 100644
22c213
--- a/tools/virtiofsd/passthrough_ll.c
22c213
+++ b/tools/virtiofsd/passthrough_ll.c
22c213
@@ -74,6 +74,21 @@ struct _uintptr_to_must_hold_fuse_ino_t_dummy_struct {
22c213
 };
22c213
 #endif
22c213
 
22c213
+struct lo_map_elem {
22c213
+    union {
22c213
+        /* Element values will go here... */
22c213
+        ssize_t freelist;
22c213
+    };
22c213
+    bool in_use;
22c213
+};
22c213
+
22c213
+/* Maps FUSE fh or ino values to internal objects */
22c213
+struct lo_map {
22c213
+    struct lo_map_elem *elems;
22c213
+    size_t nelems;
22c213
+    ssize_t freelist;
22c213
+};
22c213
+
22c213
 struct lo_inode {
22c213
     struct lo_inode *next; /* protected by lo->mutex */
22c213
     struct lo_inode *prev; /* protected by lo->mutex */
22c213
@@ -130,6 +145,115 @@ static struct lo_data *lo_data(fuse_req_t req)
22c213
     return (struct lo_data *)fuse_req_userdata(req);
22c213
 }
22c213
 
22c213
+__attribute__((unused)) static void lo_map_init(struct lo_map *map)
22c213
+{
22c213
+    map->elems = NULL;
22c213
+    map->nelems = 0;
22c213
+    map->freelist = -1;
22c213
+}
22c213
+
22c213
+__attribute__((unused)) static void lo_map_destroy(struct lo_map *map)
22c213
+{
22c213
+    free(map->elems);
22c213
+}
22c213
+
22c213
+static int lo_map_grow(struct lo_map *map, size_t new_nelems)
22c213
+{
22c213
+    struct lo_map_elem *new_elems;
22c213
+    size_t i;
22c213
+
22c213
+    if (new_nelems <= map->nelems) {
22c213
+        return 1;
22c213
+    }
22c213
+
22c213
+    new_elems = realloc(map->elems, sizeof(map->elems[0]) * new_nelems);
22c213
+    if (!new_elems) {
22c213
+        return 0;
22c213
+    }
22c213
+
22c213
+    for (i = map->nelems; i < new_nelems; i++) {
22c213
+        new_elems[i].freelist = i + 1;
22c213
+        new_elems[i].in_use = false;
22c213
+    }
22c213
+    new_elems[new_nelems - 1].freelist = -1;
22c213
+
22c213
+    map->elems = new_elems;
22c213
+    map->freelist = map->nelems;
22c213
+    map->nelems = new_nelems;
22c213
+    return 1;
22c213
+}
22c213
+
22c213
+__attribute__((unused)) static struct lo_map_elem *
22c213
+lo_map_alloc_elem(struct lo_map *map)
22c213
+{
22c213
+    struct lo_map_elem *elem;
22c213
+
22c213
+    if (map->freelist == -1 && !lo_map_grow(map, map->nelems + 256)) {
22c213
+        return NULL;
22c213
+    }
22c213
+
22c213
+    elem = &map->elems[map->freelist];
22c213
+    map->freelist = elem->freelist;
22c213
+
22c213
+    elem->in_use = true;
22c213
+
22c213
+    return elem;
22c213
+}
22c213
+
22c213
+__attribute__((unused)) static struct lo_map_elem *
22c213
+lo_map_reserve(struct lo_map *map, size_t key)
22c213
+{
22c213
+    ssize_t *prev;
22c213
+
22c213
+    if (!lo_map_grow(map, key + 1)) {
22c213
+        return NULL;
22c213
+    }
22c213
+
22c213
+    for (prev = &map->freelist; *prev != -1;
22c213
+         prev = &map->elems[*prev].freelist) {
22c213
+        if (*prev == key) {
22c213
+            struct lo_map_elem *elem = &map->elems[key];
22c213
+
22c213
+            *prev = elem->freelist;
22c213
+            elem->in_use = true;
22c213
+            return elem;
22c213
+        }
22c213
+    }
22c213
+    return NULL;
22c213
+}
22c213
+
22c213
+__attribute__((unused)) static struct lo_map_elem *
22c213
+lo_map_get(struct lo_map *map, size_t key)
22c213
+{
22c213
+    if (key >= map->nelems) {
22c213
+        return NULL;
22c213
+    }
22c213
+    if (!map->elems[key].in_use) {
22c213
+        return NULL;
22c213
+    }
22c213
+    return &map->elems[key];
22c213
+}
22c213
+
22c213
+__attribute__((unused)) static void lo_map_remove(struct lo_map *map,
22c213
+                                                  size_t key)
22c213
+{
22c213
+    struct lo_map_elem *elem;
22c213
+
22c213
+    if (key >= map->nelems) {
22c213
+        return;
22c213
+    }
22c213
+
22c213
+    elem = &map->elems[key];
22c213
+    if (!elem->in_use) {
22c213
+        return;
22c213
+    }
22c213
+
22c213
+    elem->in_use = false;
22c213
+
22c213
+    elem->freelist = map->freelist;
22c213
+    map->freelist = key;
22c213
+}
22c213
+
22c213
 static struct lo_inode *lo_inode(fuse_req_t req, fuse_ino_t ino)
22c213
 {
22c213
     if (ino == FUSE_ROOT_ID) {
22c213
-- 
22c213
1.8.3.1
22c213