[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 089/104] virtiofsd: prevent races with lo_dirp_put()
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PATCH 089/104] virtiofsd: prevent races with lo_dirp_put() |
Date: |
Thu, 12 Dec 2019 16:38:49 +0000 |
From: Stefan Hajnoczi <address@hidden>
Introduce lo_dirp_put() so that FUSE_RELEASEDIR does not cause
use-after-free races with other threads that are accessing lo_dirp.
Also make lo_releasedir() atomic to prevent FUSE_RELEASEDIR racing with
itself. This prevents double-frees.
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
tools/virtiofsd/passthrough_ll.c | 41 +++++++++++++++++++++++++++-----
1 file changed, 35 insertions(+), 6 deletions(-)
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
index eadd568435..7663e574d8 100644
--- a/tools/virtiofsd/passthrough_ll.c
+++ b/tools/virtiofsd/passthrough_ll.c
@@ -1317,11 +1317,28 @@ static void lo_readlink(fuse_req_t req, fuse_ino_t ino)
}
struct lo_dirp {
+ gint refcount;
DIR *dp;
struct dirent *entry;
off_t offset;
};
+static void lo_dirp_put(struct lo_dirp **dp)
+{
+ struct lo_dirp *d = *dp;
+
+ if (!d) {
+ return;
+ }
+ *dp = NULL;
+
+ if (g_atomic_int_dec_and_test(&d->refcount)) {
+ closedir(d->dp);
+ free(d);
+ }
+}
+
+/* Call lo_dirp_put() on the return value when no longer needed */
static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
{
struct lo_data *lo = lo_data(req);
@@ -1329,6 +1346,9 @@ static struct lo_dirp *lo_dirp(fuse_req_t req, struct
fuse_file_info *fi)
pthread_mutex_lock(&lo->mutex);
elem = lo_map_get(&lo->dirp_map, fi->fh);
+ if (elem) {
+ g_atomic_int_inc(&elem->dirp->refcount);
+ }
pthread_mutex_unlock(&lo->mutex);
if (!elem) {
return NULL;
@@ -1364,6 +1384,7 @@ static void lo_opendir(fuse_req_t req, fuse_ino_t ino,
d->offset = 0;
d->entry = NULL;
+ g_atomic_int_set(&d->refcount, 1); /* paired with lo_releasedir() */
pthread_mutex_lock(&lo->mutex);
fh = lo_add_dirp_mapping(req, d);
pthread_mutex_unlock(&lo->mutex);
@@ -1397,7 +1418,7 @@ static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino,
size_t size,
off_t offset, struct fuse_file_info *fi, int plus)
{
struct lo_data *lo = lo_data(req);
- struct lo_dirp *d;
+ struct lo_dirp *d = NULL;
struct lo_inode *dinode;
char *buf = NULL;
char *p;
@@ -1487,6 +1508,8 @@ static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino,
size_t size,
err = 0;
error:
+ lo_dirp_put(&d);
+
/*
* If there's an error, we can only signal it if we haven't stored
* any entries yet - otherwise we'd end up with wrong lookup
@@ -1517,22 +1540,25 @@ static void lo_releasedir(fuse_req_t req, fuse_ino_t
ino,
struct fuse_file_info *fi)
{
struct lo_data *lo = lo_data(req);
+ struct lo_map_elem *elem;
struct lo_dirp *d;
(void)ino;
- d = lo_dirp(req, fi);
- if (!d) {
+ pthread_mutex_lock(&lo->mutex);
+ elem = lo_map_get(&lo->dirp_map, fi->fh);
+ if (!elem) {
+ pthread_mutex_unlock(&lo->mutex);
fuse_reply_err(req, EBADF);
return;
}
- pthread_mutex_lock(&lo->mutex);
+ d = elem->dirp;
lo_map_remove(&lo->dirp_map, fi->fh);
pthread_mutex_unlock(&lo->mutex);
- closedir(d->dp);
- free(d);
+ lo_dirp_put(&d); /* paired with lo_opendir() */
+
fuse_reply_err(req, 0);
}
@@ -1743,6 +1769,9 @@ static void lo_fsyncdir(fuse_req_t req, fuse_ino_t ino,
int datasync,
} else {
res = fsync(fd);
}
+
+ lo_dirp_put(&d);
+
fuse_reply_err(req, res == -1 ? errno : 0);
}
--
2.23.0
- [PATCH 078/104] virtiofsd: cleanup allocated resource in se, (continued)
- [PATCH 078/104] virtiofsd: cleanup allocated resource in se, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 079/104] virtiofsd: fix memory leak on lo.source, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 080/104] virtiofsd: add helper for lo_data cleanup, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 081/104] virtiofsd: Prevent multiply running with same vhost_user_socket, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 082/104] virtiofsd: enable PARALLEL_DIROPS during INIT, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 084/104] Virtiofsd: fix memory leak on fuse queueinfo, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 083/104] virtiofsd: fix incorrect error handling in lo_do_lookup, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 086/104] virtiofsd: use fuse_lowlevel_is_virtio() in fuse_session_destroy(), Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 085/104] virtiofsd: Support remote posix locks, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 087/104] virtiofsd: prevent fv_queue_thread() vs virtio_loop() races, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 089/104] virtiofsd: prevent races with lo_dirp_put(),
Dr. David Alan Gilbert (git) <=
- [PATCH 088/104] virtiofsd: make lo_release() atomic, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 091/104] libvhost-user: Fix some memtable remap cases, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 090/104] virtiofsd: rename inode->refcount to inode->nlookup, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 092/104] virtiofsd: add man page, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 094/104] virtiofsd: do not always set FUSE_FLOCK_LOCKS, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 095/104] virtiofsd: convert more fprintf and perror to use fuse log infra, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 093/104] virtiofsd: introduce inode refcount to prevent use-after-free, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 096/104] virtiofsd: Reset O_DIRECT flag during file open, Dr. David Alan Gilbert (git), 2019/12/12