[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 091/111] virtiofsd: prevent races with lo_dirp_put()
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PULL 091/111] virtiofsd: prevent races with lo_dirp_put() |
Date: |
Thu, 23 Jan 2020 11:58:21 +0000 |
From: Stefan Hajnoczi <address@hidden>
Introduce lo_dirp_put() so that FUSE_RELEASEDIR does not cause
use-after-free races with other threads that are accessing lo_dirp.
Also make lo_releasedir() atomic to prevent FUSE_RELEASEDIR racing with
itself. This prevents double-frees.
Signed-off-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Dr. David Alan Gilbert <address@hidden>
---
tools/virtiofsd/passthrough_ll.c | 41 +++++++++++++++++++++++++++-----
1 file changed, 35 insertions(+), 6 deletions(-)
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
index 690edbc4c5..2d703b57e5 100644
--- a/tools/virtiofsd/passthrough_ll.c
+++ b/tools/virtiofsd/passthrough_ll.c
@@ -1284,11 +1284,28 @@ static void lo_readlink(fuse_req_t req, fuse_ino_t ino)
}
struct lo_dirp {
+ gint refcount;
DIR *dp;
struct dirent *entry;
off_t offset;
};
+static void lo_dirp_put(struct lo_dirp **dp)
+{
+ struct lo_dirp *d = *dp;
+
+ if (!d) {
+ return;
+ }
+ *dp = NULL;
+
+ if (g_atomic_int_dec_and_test(&d->refcount)) {
+ closedir(d->dp);
+ free(d);
+ }
+}
+
+/* Call lo_dirp_put() on the return value when no longer needed */
static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
{
struct lo_data *lo = lo_data(req);
@@ -1296,6 +1313,9 @@ static struct lo_dirp *lo_dirp(fuse_req_t req, struct
fuse_file_info *fi)
pthread_mutex_lock(&lo->mutex);
elem = lo_map_get(&lo->dirp_map, fi->fh);
+ if (elem) {
+ g_atomic_int_inc(&elem->dirp->refcount);
+ }
pthread_mutex_unlock(&lo->mutex);
if (!elem) {
return NULL;
@@ -1331,6 +1351,7 @@ static void lo_opendir(fuse_req_t req, fuse_ino_t ino,
d->offset = 0;
d->entry = NULL;
+ g_atomic_int_set(&d->refcount, 1); /* paired with lo_releasedir() */
pthread_mutex_lock(&lo->mutex);
fh = lo_add_dirp_mapping(req, d);
pthread_mutex_unlock(&lo->mutex);
@@ -1364,7 +1385,7 @@ static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino,
size_t size,
off_t offset, struct fuse_file_info *fi, int plus)
{
struct lo_data *lo = lo_data(req);
- struct lo_dirp *d;
+ struct lo_dirp *d = NULL;
struct lo_inode *dinode;
char *buf = NULL;
char *p;
@@ -1454,6 +1475,8 @@ static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino,
size_t size,
err = 0;
error:
+ lo_dirp_put(&d);
+
/*
* If there's an error, we can only signal it if we haven't stored
* any entries yet - otherwise we'd end up with wrong lookup
@@ -1484,22 +1507,25 @@ static void lo_releasedir(fuse_req_t req, fuse_ino_t
ino,
struct fuse_file_info *fi)
{
struct lo_data *lo = lo_data(req);
+ struct lo_map_elem *elem;
struct lo_dirp *d;
(void)ino;
- d = lo_dirp(req, fi);
- if (!d) {
+ pthread_mutex_lock(&lo->mutex);
+ elem = lo_map_get(&lo->dirp_map, fi->fh);
+ if (!elem) {
+ pthread_mutex_unlock(&lo->mutex);
fuse_reply_err(req, EBADF);
return;
}
- pthread_mutex_lock(&lo->mutex);
+ d = elem->dirp;
lo_map_remove(&lo->dirp_map, fi->fh);
pthread_mutex_unlock(&lo->mutex);
- closedir(d->dp);
- free(d);
+ lo_dirp_put(&d); /* paired with lo_opendir() */
+
fuse_reply_err(req, 0);
}
@@ -1710,6 +1736,9 @@ static void lo_fsyncdir(fuse_req_t req, fuse_ino_t ino,
int datasync,
} else {
res = fsync(fd);
}
+
+ lo_dirp_put(&d);
+
fuse_reply_err(req, res == -1 ? errno : 0);
}
--
2.24.1
- [PULL 075/111] virtiofsd: passthrough_ll: clean up cache related options, (continued)
- [PULL 075/111] virtiofsd: passthrough_ll: clean up cache related options, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 077/111] virtiofsd: Clean up inodes on destroy, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 080/111] virtiofsd: cleanup allocated resource in se, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 081/111] virtiofsd: fix memory leak on lo.source, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 079/111] virtiofsd: fix error handling in main(), Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 078/111] virtiofsd: support nanosecond resolution for file timestamp, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 082/111] virtiofsd: add helper for lo_data cleanup, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 090/111] virtiofsd: make lo_release() atomic, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 089/111] virtiofsd: prevent fv_queue_thread() vs virtio_loop() races, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 074/111] virtiofsd: extract root inode init into setup_root(), Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 091/111] virtiofsd: prevent races with lo_dirp_put(),
Dr. David Alan Gilbert (git) <=
- [PULL 086/111] Virtiofsd: fix memory leak on fuse queueinfo, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 095/111] virtiofsd: passthrough_ll: fix refcounting on remove/rename, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 101/111] virtiofsd: passthrough_ll: Use cache_readdir for directory open, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 107/111] virtiofsd: add --thread-pool-size=NUM option, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 088/111] virtiofsd: use fuse_lowlevel_is_virtio() in fuse_session_destroy(), Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 087/111] virtiofsd: Support remote posix locks, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 083/111] virtiofsd: Prevent multiply running with same vhost_user_socket, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 085/111] virtiofsd: fix incorrect error handling in lo_do_lookup, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 071/111] virtiofsd: passthrough_ll: control readdirplus, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 084/111] virtiofsd: enable PARALLEL_DIROPS during INIT, Dr. David Alan Gilbert (git), 2020/01/23