yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-virtiofsd-passthrough_ll-add-lo_map-for-ino-fh-indir.patch

902636
From d56651e227bae83ee0cceb12bd91e3e9f6045ab3 Mon Sep 17 00:00:00 2001
902636
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
902636
Date: Mon, 27 Jan 2020 19:01:13 +0100
902636
Subject: [PATCH 042/116] virtiofsd: passthrough_ll: add lo_map for ino/fh
902636
 indirection
902636
MIME-Version: 1.0
902636
Content-Type: text/plain; charset=UTF-8
902636
Content-Transfer-Encoding: 8bit
902636
902636
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
902636
Message-id: <20200127190227.40942-39-dgilbert@redhat.com>
902636
Patchwork-id: 93492
902636
O-Subject: [RHEL-AV-8.2 qemu-kvm PATCH 038/112] virtiofsd: passthrough_ll: add lo_map for ino/fh indirection
902636
Bugzilla: 1694164
902636
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
902636
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
902636
RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
902636
902636
From: Stefan Hajnoczi <stefanha@redhat.com>
902636
902636
A layer of indirection is needed because passthrough_ll cannot expose
902636
pointers or file descriptor numbers to untrusted clients.  Malicious
902636
clients could send invalid pointers or file descriptors in order to
902636
crash or exploit the file system daemon.
902636
902636
lo_map provides an integer key->value mapping.  This will be used for
902636
ino and fh fields in the patches that follow.
902636
902636
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
902636
Reviewed-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
902636
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
902636
(cherry picked from commit 25c135727b08dca90f00094e522a69170b13dfac)
902636
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
902636
---
902636
 tools/virtiofsd/passthrough_ll.c | 124 +++++++++++++++++++++++++++++++++++++++
902636
 1 file changed, 124 insertions(+)
902636
902636
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
902636
index 5e06179..e83a976 100644
902636
--- a/tools/virtiofsd/passthrough_ll.c
902636
+++ b/tools/virtiofsd/passthrough_ll.c
902636
@@ -74,6 +74,21 @@ struct _uintptr_to_must_hold_fuse_ino_t_dummy_struct {
902636
 };
902636
 #endif
902636
 
902636
+struct lo_map_elem {
902636
+    union {
902636
+        /* Element values will go here... */
902636
+        ssize_t freelist;
902636
+    };
902636
+    bool in_use;
902636
+};
902636
+
902636
+/* Maps FUSE fh or ino values to internal objects */
902636
+struct lo_map {
902636
+    struct lo_map_elem *elems;
902636
+    size_t nelems;
902636
+    ssize_t freelist;
902636
+};
902636
+
902636
 struct lo_inode {
902636
     struct lo_inode *next; /* protected by lo->mutex */
902636
     struct lo_inode *prev; /* protected by lo->mutex */
902636
@@ -130,6 +145,115 @@ static struct lo_data *lo_data(fuse_req_t req)
902636
     return (struct lo_data *)fuse_req_userdata(req);
902636
 }
902636
 
902636
+__attribute__((unused)) static void lo_map_init(struct lo_map *map)
902636
+{
902636
+    map->elems = NULL;
902636
+    map->nelems = 0;
902636
+    map->freelist = -1;
902636
+}
902636
+
902636
+__attribute__((unused)) static void lo_map_destroy(struct lo_map *map)
902636
+{
902636
+    free(map->elems);
902636
+}
902636
+
902636
+static int lo_map_grow(struct lo_map *map, size_t new_nelems)
902636
+{
902636
+    struct lo_map_elem *new_elems;
902636
+    size_t i;
902636
+
902636
+    if (new_nelems <= map->nelems) {
902636
+        return 1;
902636
+    }
902636
+
902636
+    new_elems = realloc(map->elems, sizeof(map->elems[0]) * new_nelems);
902636
+    if (!new_elems) {
902636
+        return 0;
902636
+    }
902636
+
902636
+    for (i = map->nelems; i < new_nelems; i++) {
902636
+        new_elems[i].freelist = i + 1;
902636
+        new_elems[i].in_use = false;
902636
+    }
902636
+    new_elems[new_nelems - 1].freelist = -1;
902636
+
902636
+    map->elems = new_elems;
902636
+    map->freelist = map->nelems;
902636
+    map->nelems = new_nelems;
902636
+    return 1;
902636
+}
902636
+
902636
+__attribute__((unused)) static struct lo_map_elem *
902636
+lo_map_alloc_elem(struct lo_map *map)
902636
+{
902636
+    struct lo_map_elem *elem;
902636
+
902636
+    if (map->freelist == -1 && !lo_map_grow(map, map->nelems + 256)) {
902636
+        return NULL;
902636
+    }
902636
+
902636
+    elem = &map->elems[map->freelist];
902636
+    map->freelist = elem->freelist;
902636
+
902636
+    elem->in_use = true;
902636
+
902636
+    return elem;
902636
+}
902636
+
902636
+__attribute__((unused)) static struct lo_map_elem *
902636
+lo_map_reserve(struct lo_map *map, size_t key)
902636
+{
902636
+    ssize_t *prev;
902636
+
902636
+    if (!lo_map_grow(map, key + 1)) {
902636
+        return NULL;
902636
+    }
902636
+
902636
+    for (prev = &map->freelist; *prev != -1;
902636
+         prev = &map->elems[*prev].freelist) {
902636
+        if (*prev == key) {
902636
+            struct lo_map_elem *elem = &map->elems[key];
902636
+
902636
+            *prev = elem->freelist;
902636
+            elem->in_use = true;
902636
+            return elem;
902636
+        }
902636
+    }
902636
+    return NULL;
902636
+}
902636
+
902636
+__attribute__((unused)) static struct lo_map_elem *
902636
+lo_map_get(struct lo_map *map, size_t key)
902636
+{
902636
+    if (key >= map->nelems) {
902636
+        return NULL;
902636
+    }
902636
+    if (!map->elems[key].in_use) {
902636
+        return NULL;
902636
+    }
902636
+    return &map->elems[key];
902636
+}
902636
+
902636
+__attribute__((unused)) static void lo_map_remove(struct lo_map *map,
902636
+                                                  size_t key)
902636
+{
902636
+    struct lo_map_elem *elem;
902636
+
902636
+    if (key >= map->nelems) {
902636
+        return;
902636
+    }
902636
+
902636
+    elem = &map->elems[key];
902636
+    if (!elem->in_use) {
902636
+        return;
902636
+    }
902636
+
902636
+    elem->in_use = false;
902636
+
902636
+    elem->freelist = map->freelist;
902636
+    map->freelist = key;
902636
+}
902636
+
902636
 static struct lo_inode *lo_inode(fuse_req_t req, fuse_ino_t ino)
902636
 {
902636
     if (ino == FUSE_ROOT_ID) {
902636
-- 
902636
1.8.3.1
902636