tools/virtiofsd/passthrough_ll.c

   1 /*
   2  * FUSE: Filesystem in Userspace
   3  * Copyright (C) 2001-2007  Miklos Szeredi <miklos@szeredi.hu>
   4  *
   5  * This program can be distributed under the terms of the GNU GPLv2.
   6  * See the file COPYING.
   7  */
   8
   9 /*
  10  *
  11  * This file system mirrors the existing file system hierarchy of the
  12  * system, starting at the root file system. This is implemented by
  13  * just "passing through" all requests to the corresponding user-space
  14  * libc functions. In contrast to passthrough.c and passthrough_fh.c,
  15  * this implementation uses the low-level API. Its performance should
  16  * be the least bad among the three, but many operations are not
  17  * implemented. In particular, it is not possible to remove files (or
  18  * directories) because the code necessary to defer actual removal
  19  * until the file is not opened anymore would make the example much
  20  * more complicated.
  21  *
  22  * When writeback caching is enabled (-o writeback mount option), it
  23  * is only possible to write to files for which the mounting user has
  24  * read permissions. This is because the writeback cache requires the
  25  * kernel to be able to issue read requests for all files (which the
  26  * passthrough filesystem cannot satisfy if it can't read the file in
  27  * the underlying filesystem).
  28  *
  29  * Compile with:
  30  *
  31  *     gcc -Wall passthrough_ll.c `pkg-config fuse3 --cflags --libs` -o
  32  * passthrough_ll
  33  *
  34  * ## Source code ##
  35  * \include passthrough_ll.c
  36  */
  37
  38 #include "qemu/osdep.h"
  39 #include "qemu/timer.h"
  40 #include "fuse_virtio.h"
  41 #include "fuse_log.h"
  42 #include "fuse_lowlevel.h"
  43 #include <assert.h>
  44 #include <cap-ng.h>
  45 #include <dirent.h>
  46 #include <errno.h>
  47 #include <glib.h>
  48 #include <inttypes.h>
  49 #include <limits.h>
  50 #include <pthread.h>
  51 #include <stdbool.h>
  52 #include <stddef.h>
  53 #include <stdio.h>
  54 #include <stdlib.h>
  55 #include <string.h>
  56 #include <sys/file.h>
  57 #include <sys/mount.h>
  58 #include <sys/prctl.h>
  59 #include <sys/resource.h>
  60 #include <sys/syscall.h>
  61 #include <sys/types.h>
  62 #include <sys/wait.h>
  63 #include <sys/xattr.h>
  64 #include <syslog.h>
  65 #include <unistd.h>
  66
  67 #include "passthrough_helpers.h"
  68 #include "seccomp.h"
  69
  70 /* Keep track of inode posix locks for each owner. */
  71 struct lo_inode_plock {
  72     uint64_t lock_owner;
  73     int fd; /* fd for OFD locks */
  74 };
  75
  76 struct lo_map_elem {
  77     union {
  78         struct lo_inode *inode;
  79         struct lo_dirp *dirp;
  80         int fd;
  81         ssize_t freelist;
  82     };
  83     bool in_use;
  84 };
  85
  86 /* Maps FUSE fh or ino values to internal objects */
  87 struct lo_map {
  88     struct lo_map_elem *elems;
  89     size_t nelems;
  90     ssize_t freelist;
  91 };
  92
  93 struct lo_key {
  94     ino_t ino;
  95     dev_t dev;
  96 };
  97
  98 struct lo_inode {
  99     int fd;
 100
 101     /*
 102      * Atomic reference count for this object.  The nlookup field holds a
 103      * reference and release it when nlookup reaches 0.
 104      */
 105     gint refcount;
 106
 107     struct lo_key key;
 108
 109     /*
 110      * This counter keeps the inode alive during the FUSE session.
 111      * Incremented when the FUSE inode number is sent in a reply
 112      * (FUSE_LOOKUP, FUSE_READDIRPLUS, etc).  Decremented when an inode is
 113      * released by requests like FUSE_FORGET, FUSE_RMDIR, FUSE_RENAME, etc.
 114      *
 115      * Note that this value is untrusted because the client can manipulate
 116      * it arbitrarily using FUSE_FORGET requests.
 117      *
 118      * Protected by lo->mutex.
 119      */
 120     uint64_t nlookup;
 121
 122     fuse_ino_t fuse_ino;
 123     pthread_mutex_t plock_mutex;
 124     GHashTable *posix_locks; /* protected by lo_inode->plock_mutex */
 125
 126     mode_t filetype;
 127 };
 128
 129 struct lo_cred {
 130     uid_t euid;
 131     gid_t egid;
 132 };
 133
 134 enum {
 135     CACHE_NONE,
 136     CACHE_AUTO,
 137     CACHE_ALWAYS,
 138 };
 139
 140 struct lo_data {
 141     pthread_mutex_t mutex;
 142     int debug;
 143     int writeback;
 144     int flock;
 145     int posix_lock;
 146     int xattr;
 147     char *source;
 148     double timeout;
 149     int cache;
 150     int timeout_set;
 151     int readdirplus_set;
 152     int readdirplus_clear;
 153     struct lo_inode root;
 154     GHashTable *inodes; /* protected by lo->mutex */
 155     struct lo_map ino_map; /* protected by lo->mutex */
 156     struct lo_map dirp_map; /* protected by lo->mutex */
 157     struct lo_map fd_map; /* protected by lo->mutex */
 158
 159     /* An O_PATH file descriptor to /proc/self/fd/ */
 160     int proc_self_fd;
 161 };
 162
 163 static const struct fuse_opt lo_opts[] = {
 164     { "writeback", offsetof(struct lo_data, writeback), 1 },
 165     { "no_writeback", offsetof(struct lo_data, writeback), 0 },
 166     { "source=%s", offsetof(struct lo_data, source), 0 },
 167     { "flock", offsetof(struct lo_data, flock), 1 },
 168     { "no_flock", offsetof(struct lo_data, flock), 0 },
 169     { "posix_lock", offsetof(struct lo_data, posix_lock), 1 },
 170     { "no_posix_lock", offsetof(struct lo_data, posix_lock), 0 },
 171     { "xattr", offsetof(struct lo_data, xattr), 1 },
 172     { "no_xattr", offsetof(struct lo_data, xattr), 0 },
 173     { "timeout=%lf", offsetof(struct lo_data, timeout), 0 },
 174     { "timeout=", offsetof(struct lo_data, timeout_set), 1 },
 175     { "cache=none", offsetof(struct lo_data, cache), CACHE_NONE },
 176     { "cache=auto", offsetof(struct lo_data, cache), CACHE_AUTO },
 177     { "cache=always", offsetof(struct lo_data, cache), CACHE_ALWAYS },
 178     { "readdirplus", offsetof(struct lo_data, readdirplus_set), 1 },
 179     { "no_readdirplus", offsetof(struct lo_data, readdirplus_clear), 1 },
 180     FUSE_OPT_END
 181 };
 182 static bool use_syslog = false;
 183 static int current_log_level;
 184 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
 185                                  uint64_t n);
 186
 187 static struct {
 188     pthread_mutex_t mutex;
 189     void *saved;
 190 } cap;
 191 /* That we loaded cap-ng in the current thread from the saved */
 192 static __thread bool cap_loaded = 0;
 193
 194 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
 195
 196 static int is_dot_or_dotdot(const char *name)
 197 {
 198     return name[0] == '.' &&
 199            (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
 200 }
 201
 202 /* Is `path` a single path component that is not "." or ".."? */
 203 static int is_safe_path_component(const char *path)
 204 {
 205     if (strchr(path, '/')) {
 206         return 0;
 207     }
 208
 209     return !is_dot_or_dotdot(path);
 210 }
 211
 212 static struct lo_data *lo_data(fuse_req_t req)
 213 {
 214     return (struct lo_data *)fuse_req_userdata(req);
 215 }
 216
 217 /*
 218  * Load capng's state from our saved state if the current thread
 219  * hadn't previously been loaded.
 220  * returns 0 on success
 221  */
 222 static int load_capng(void)
 223 {
 224     if (!cap_loaded) {
 225         pthread_mutex_lock(&cap.mutex);
 226         capng_restore_state(&cap.saved);
 227         /*
 228          * restore_state free's the saved copy
 229          * so make another.
 230          */
 231         cap.saved = capng_save_state();
 232         if (!cap.saved) {
 233             pthread_mutex_unlock(&cap.mutex);
 234             fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
 235             return -EINVAL;
 236         }
 237         pthread_mutex_unlock(&cap.mutex);
 238
 239         /*
 240          * We want to use the loaded state for our pid,
 241          * not the original
 242          */
 243         capng_setpid(syscall(SYS_gettid));
 244         cap_loaded = true;
 245     }
 246     return 0;
 247 }
 248
 249 /*
 250  * Helpers for dropping and regaining effective capabilities. Returns 0
 251  * on success, error otherwise
 252  */
 253 static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
 254 {
 255     int cap, ret;
 256
 257     cap = capng_name_to_capability(cap_name);
 258     if (cap < 0) {
 259         ret = errno;
 260         fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
 261                  cap_name, strerror(errno));
 262         goto out;
 263     }
 264
 265     if (load_capng()) {
 266         ret = errno;
 267         fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 268         goto out;
 269     }
 270
 271     /* We dont have this capability in effective set already. */
 272     if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
 273         ret = 0;
 274         goto out;
 275     }
 276
 277     if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
 278         ret = errno;
 279         fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
 280         goto out;
 281     }
 282
 283     if (capng_apply(CAPNG_SELECT_CAPS)) {
 284         ret = errno;
 285         fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
 286         goto out;
 287     }
 288
 289     ret = 0;
 290     if (cap_dropped) {
 291         *cap_dropped = true;
 292     }
 293
 294 out:
 295     return ret;
 296 }
 297
 298 static int gain_effective_cap(const char *cap_name)
 299 {
 300     int cap;
 301     int ret = 0;
 302
 303     cap = capng_name_to_capability(cap_name);
 304     if (cap < 0) {
 305         ret = errno;
 306         fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
 307                  cap_name, strerror(errno));
 308         goto out;
 309     }
 310
 311     if (load_capng()) {
 312         ret = errno;
 313         fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 314         goto out;
 315     }
 316
 317     if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
 318         ret = errno;
 319         fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
 320         goto out;
 321     }
 322
 323     if (capng_apply(CAPNG_SELECT_CAPS)) {
 324         ret = errno;
 325         fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
 326         goto out;
 327     }
 328     ret = 0;
 329
 330 out:
 331     return ret;
 332 }
 333
 334 static void lo_map_init(struct lo_map *map)
 335 {
 336     map->elems = NULL;
 337     map->nelems = 0;
 338     map->freelist = -1;
 339 }
 340
 341 static void lo_map_destroy(struct lo_map *map)
 342 {
 343     free(map->elems);
 344 }
 345
 346 static int lo_map_grow(struct lo_map *map, size_t new_nelems)
 347 {
 348     struct lo_map_elem *new_elems;
 349     size_t i;
 350
 351     if (new_nelems <= map->nelems) {
 352         return 1;
 353     }
 354
 355     new_elems = realloc(map->elems, sizeof(map->elems[0]) * new_nelems);
 356     if (!new_elems) {
 357         return 0;
 358     }
 359
 360     for (i = map->nelems; i < new_nelems; i++) {
 361         new_elems[i].freelist = i + 1;
 362         new_elems[i].in_use = false;
 363     }
 364     new_elems[new_nelems - 1].freelist = -1;
 365
 366     map->elems = new_elems;
 367     map->freelist = map->nelems;
 368     map->nelems = new_nelems;
 369     return 1;
 370 }
 371
 372 static struct lo_map_elem *lo_map_alloc_elem(struct lo_map *map)
 373 {
 374     struct lo_map_elem *elem;
 375
 376     if (map->freelist == -1 && !lo_map_grow(map, map->nelems + 256)) {
 377         return NULL;
 378     }
 379
 380     elem = &map->elems[map->freelist];
 381     map->freelist = elem->freelist;
 382
 383     elem->in_use = true;
 384
 385     return elem;
 386 }
 387
 388 static struct lo_map_elem *lo_map_reserve(struct lo_map *map, size_t key)
 389 {
 390     ssize_t *prev;
 391
 392     if (!lo_map_grow(map, key + 1)) {
 393         return NULL;
 394     }
 395
 396     for (prev = &map->freelist; *prev != -1;
 397          prev = &map->elems[*prev].freelist) {
 398         if (*prev == key) {
 399             struct lo_map_elem *elem = &map->elems[key];
 400
 401             *prev = elem->freelist;
 402             elem->in_use = true;
 403             return elem;
 404         }
 405     }
 406     return NULL;
 407 }
 408
 409 static struct lo_map_elem *lo_map_get(struct lo_map *map, size_t key)
 410 {
 411     if (key >= map->nelems) {
 412         return NULL;
 413     }
 414     if (!map->elems[key].in_use) {
 415         return NULL;
 416     }
 417     return &map->elems[key];
 418 }
 419
 420 static void lo_map_remove(struct lo_map *map, size_t key)
 421 {
 422     struct lo_map_elem *elem;
 423
 424     if (key >= map->nelems) {
 425         return;
 426     }
 427
 428     elem = &map->elems[key];
 429     if (!elem->in_use) {
 430         return;
 431     }
 432
 433     elem->in_use = false;
 434
 435     elem->freelist = map->freelist;
 436     map->freelist = key;
 437 }
 438
 439 /* Assumes lo->mutex is held */
 440 static ssize_t lo_add_fd_mapping(fuse_req_t req, int fd)
 441 {
 442     struct lo_map_elem *elem;
 443
 444     elem = lo_map_alloc_elem(&lo_data(req)->fd_map);
 445     if (!elem) {
 446         return -1;
 447     }
 448
 449     elem->fd = fd;
 450     return elem - lo_data(req)->fd_map.elems;
 451 }
 452
 453 /* Assumes lo->mutex is held */
 454 static ssize_t lo_add_dirp_mapping(fuse_req_t req, struct lo_dirp *dirp)
 455 {
 456     struct lo_map_elem *elem;
 457
 458     elem = lo_map_alloc_elem(&lo_data(req)->dirp_map);
 459     if (!elem) {
 460         return -1;
 461     }
 462
 463     elem->dirp = dirp;
 464     return elem - lo_data(req)->dirp_map.elems;
 465 }
 466
 467 /* Assumes lo->mutex is held */
 468 static ssize_t lo_add_inode_mapping(fuse_req_t req, struct lo_inode *inode)
 469 {
 470     struct lo_map_elem *elem;
 471
 472     elem = lo_map_alloc_elem(&lo_data(req)->ino_map);
 473     if (!elem) {
 474         return -1;
 475     }
 476
 477     elem->inode = inode;
 478     return elem - lo_data(req)->ino_map.elems;
 479 }
 480
 481 static void lo_inode_put(struct lo_data *lo, struct lo_inode **inodep)
 482 {
 483     struct lo_inode *inode = *inodep;
 484
 485     if (!inode) {
 486         return;
 487     }
 488
 489     *inodep = NULL;
 490
 491     if (g_atomic_int_dec_and_test(&inode->refcount)) {
 492         close(inode->fd);
 493         free(inode);
 494     }
 495 }
 496
 497 /* Caller must release refcount using lo_inode_put() */
 498 static struct lo_inode *lo_inode(fuse_req_t req, fuse_ino_t ino)
 499 {
 500     struct lo_data *lo = lo_data(req);
 501     struct lo_map_elem *elem;
 502
 503     pthread_mutex_lock(&lo->mutex);
 504     elem = lo_map_get(&lo->ino_map, ino);
 505     if (elem) {
 506         g_atomic_int_inc(&elem->inode->refcount);
 507     }
 508     pthread_mutex_unlock(&lo->mutex);
 509
 510     if (!elem) {
 511         return NULL;
 512     }
 513
 514     return elem->inode;
 515 }
 516
 517 /*
 518  * TODO Remove this helper and force callers to hold an inode refcount until
 519  * they are done with the fd.  This will be done in a later patch to make
 520  * review easier.
 521  */
 522 static int lo_fd(fuse_req_t req, fuse_ino_t ino)
 523 {
 524     struct lo_inode *inode = lo_inode(req, ino);
 525     int fd;
 526
 527     if (!inode) {
 528         return -1;
 529     }
 530
 531     fd = inode->fd;
 532     lo_inode_put(lo_data(req), &inode);
 533     return fd;
 534 }
 535
 536 static void lo_init(void *userdata, struct fuse_conn_info *conn)
 537 {
 538     struct lo_data *lo = (struct lo_data *)userdata;
 539
 540     if (conn->capable & FUSE_CAP_EXPORT_SUPPORT) {
 541         conn->want |= FUSE_CAP_EXPORT_SUPPORT;
 542     }
 543
 544     if (lo->writeback && conn->capable & FUSE_CAP_WRITEBACK_CACHE) {
 545         fuse_log(FUSE_LOG_DEBUG, "lo_init: activating writeback\n");
 546         conn->want |= FUSE_CAP_WRITEBACK_CACHE;
 547     }
 548     if (conn->capable & FUSE_CAP_FLOCK_LOCKS) {
 549         if (lo->flock) {
 550             fuse_log(FUSE_LOG_DEBUG, "lo_init: activating flock locks\n");
 551             conn->want |= FUSE_CAP_FLOCK_LOCKS;
 552         } else {
 553             fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling flock locks\n");
 554             conn->want &= ~FUSE_CAP_FLOCK_LOCKS;
 555         }
 556     }
 557
 558     if (conn->capable & FUSE_CAP_POSIX_LOCKS) {
 559         if (lo->posix_lock) {
 560             fuse_log(FUSE_LOG_DEBUG, "lo_init: activating posix locks\n");
 561             conn->want |= FUSE_CAP_POSIX_LOCKS;
 562         } else {
 563             fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling posix locks\n");
 564             conn->want &= ~FUSE_CAP_POSIX_LOCKS;
 565         }
 566     }
 567
 568     if ((lo->cache == CACHE_NONE && !lo->readdirplus_set) ||
 569         lo->readdirplus_clear) {
 570         fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling readdirplus\n");
 571         conn->want &= ~FUSE_CAP_READDIRPLUS;
 572     }
 573 }
 574
 575 static void lo_getattr(fuse_req_t req, fuse_ino_t ino,
 576                        struct fuse_file_info *fi)
 577 {
 578     int res;
 579     struct stat buf;
 580     struct lo_data *lo = lo_data(req);
 581
 582     (void)fi;
 583
 584     res =
 585         fstatat(lo_fd(req, ino), "", &buf, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 586     if (res == -1) {
 587         return (void)fuse_reply_err(req, errno);
 588     }
 589
 590     fuse_reply_attr(req, &buf, lo->timeout);
 591 }
 592
 593 static int lo_fi_fd(fuse_req_t req, struct fuse_file_info *fi)
 594 {
 595     struct lo_data *lo = lo_data(req);
 596     struct lo_map_elem *elem;
 597
 598     pthread_mutex_lock(&lo->mutex);
 599     elem = lo_map_get(&lo->fd_map, fi->fh);
 600     pthread_mutex_unlock(&lo->mutex);
 601
 602     if (!elem) {
 603         return -1;
 604     }
 605
 606     return elem->fd;
 607 }
 608
 609 static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,
 610                        int valid, struct fuse_file_info *fi)
 611 {
 612     int saverr;
 613     char procname[64];
 614     struct lo_data *lo = lo_data(req);
 615     struct lo_inode *inode;
 616     int ifd;
 617     int res;
 618     int fd;
 619
 620     inode = lo_inode(req, ino);
 621     if (!inode) {
 622         fuse_reply_err(req, EBADF);
 623         return;
 624     }
 625
 626     ifd = inode->fd;
 627
 628     /* If fi->fh is invalid we'll report EBADF later */
 629     if (fi) {
 630         fd = lo_fi_fd(req, fi);
 631     }
 632
 633     if (valid & FUSE_SET_ATTR_MODE) {
 634         if (fi) {
 635             res = fchmod(fd, attr->st_mode);
 636         } else {
 637             sprintf(procname, "%i", ifd);
 638             res = fchmodat(lo->proc_self_fd, procname, attr->st_mode, 0);
 639         }
 640         if (res == -1) {
 641             goto out_err;
 642         }
 643     }
 644     if (valid & (FUSE_SET_ATTR_UID | FUSE_SET_ATTR_GID)) {
 645         uid_t uid = (valid & FUSE_SET_ATTR_UID) ? attr->st_uid : (uid_t)-1;
 646         gid_t gid = (valid & FUSE_SET_ATTR_GID) ? attr->st_gid : (gid_t)-1;
 647
 648         res = fchownat(ifd, "", uid, gid, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 649         if (res == -1) {
 650             goto out_err;
 651         }
 652     }
 653     if (valid & FUSE_SET_ATTR_SIZE) {
 654         int truncfd;
 655
 656         if (fi) {
 657             truncfd = fd;
 658         } else {
 659             sprintf(procname, "%i", ifd);
 660             truncfd = openat(lo->proc_self_fd, procname, O_RDWR);
 661             if (truncfd < 0) {
 662                 goto out_err;
 663             }
 664         }
 665
 666         res = ftruncate(truncfd, attr->st_size);
 667         if (!fi) {
 668             saverr = errno;
 669             close(truncfd);
 670             errno = saverr;
 671         }
 672         if (res == -1) {
 673             goto out_err;
 674         }
 675     }
 676     if (valid & (FUSE_SET_ATTR_ATIME | FUSE_SET_ATTR_MTIME)) {
 677         struct timespec tv[2];
 678
 679         tv[0].tv_sec = 0;
 680         tv[1].tv_sec = 0;
 681         tv[0].tv_nsec = UTIME_OMIT;
 682         tv[1].tv_nsec = UTIME_OMIT;
 683
 684         if (valid & FUSE_SET_ATTR_ATIME_NOW) {
 685             tv[0].tv_nsec = UTIME_NOW;
 686         } else if (valid & FUSE_SET_ATTR_ATIME) {
 687             tv[0] = attr->st_atim;
 688         }
 689
 690         if (valid & FUSE_SET_ATTR_MTIME_NOW) {
 691             tv[1].tv_nsec = UTIME_NOW;
 692         } else if (valid & FUSE_SET_ATTR_MTIME) {
 693             tv[1] = attr->st_mtim;
 694         }
 695
 696         if (fi) {
 697             res = futimens(fd, tv);
 698         } else {
 699             sprintf(procname, "%i", inode->fd);
 700             res = utimensat(lo->proc_self_fd, procname, tv, 0);
 701         }
 702         if (res == -1) {
 703             goto out_err;
 704         }
 705     }
 706     lo_inode_put(lo, &inode);
 707
 708     return lo_getattr(req, ino, fi);
 709
 710 out_err:
 711     saverr = errno;
 712     lo_inode_put(lo, &inode);
 713     fuse_reply_err(req, saverr);
 714 }
 715
 716 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st)
 717 {
 718     struct lo_inode *p;
 719     struct lo_key key = {
 720         .ino = st->st_ino,
 721         .dev = st->st_dev,
 722     };
 723
 724     pthread_mutex_lock(&lo->mutex);
 725     p = g_hash_table_lookup(lo->inodes, &key);
 726     if (p) {
 727         assert(p->nlookup > 0);
 728         p->nlookup++;
 729         g_atomic_int_inc(&p->refcount);
 730     }
 731     pthread_mutex_unlock(&lo->mutex);
 732
 733     return p;
 734 }
 735
 736 /* value_destroy_func for posix_locks GHashTable */
 737 static void posix_locks_value_destroy(gpointer data)
 738 {
 739     struct lo_inode_plock *plock = data;
 740
 741     /*
 742      * We had used open() for locks and had only one fd. So
 743      * closing this fd should release all OFD locks.
 744      */
 745     close(plock->fd);
 746     free(plock);
 747 }
 748
 749 /*
 750  * Increments nlookup and caller must release refcount using
 751  * lo_inode_put(&parent).
 752  */
 753 static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
 754                         struct fuse_entry_param *e)
 755 {
 756     int newfd;
 757     int res;
 758     int saverr;
 759     struct lo_data *lo = lo_data(req);
 760     struct lo_inode *inode = NULL;
 761     struct lo_inode *dir = lo_inode(req, parent);
 762
 763     /*
 764      * name_to_handle_at() and open_by_handle_at() can reach here with fuse
 765      * mount point in guest, but we don't have its inode info in the
 766      * ino_map.
 767      */
 768     if (!dir) {
 769         return ENOENT;
 770     }
 771
 772     memset(e, 0, sizeof(*e));
 773     e->attr_timeout = lo->timeout;
 774     e->entry_timeout = lo->timeout;
 775
 776     /* Do not allow escaping root directory */
 777     if (dir == &lo->root && strcmp(name, "..") == 0) {
 778         name = ".";
 779     }
 780
 781     newfd = openat(dir->fd, name, O_PATH | O_NOFOLLOW);
 782     if (newfd == -1) {
 783         goto out_err;
 784     }
 785
 786     res = fstatat(newfd, "", &e->attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 787     if (res == -1) {
 788         goto out_err;
 789     }
 790
 791     inode = lo_find(lo, &e->attr);
 792     if (inode) {
 793         close(newfd);
 794     } else {
 795         inode = calloc(1, sizeof(struct lo_inode));
 796         if (!inode) {
 797             goto out_err;
 798         }
 799
 800         /* cache only filetype */
 801         inode->filetype = (e->attr.st_mode & S_IFMT);
 802
 803         /*
 804          * One for the caller and one for nlookup (released in
 805          * unref_inode_lolocked())
 806          */
 807         g_atomic_int_set(&inode->refcount, 2);
 808
 809         inode->nlookup = 1;
 810         inode->fd = newfd;
 811         inode->key.ino = e->attr.st_ino;
 812         inode->key.dev = e->attr.st_dev;
 813         pthread_mutex_init(&inode->plock_mutex, NULL);
 814         inode->posix_locks = g_hash_table_new_full(
 815             g_direct_hash, g_direct_equal, NULL, posix_locks_value_destroy);
 816
 817         pthread_mutex_lock(&lo->mutex);
 818         inode->fuse_ino = lo_add_inode_mapping(req, inode);
 819         g_hash_table_insert(lo->inodes, &inode->key, inode);
 820         pthread_mutex_unlock(&lo->mutex);
 821     }
 822     e->ino = inode->fuse_ino;
 823     lo_inode_put(lo, &inode);
 824     lo_inode_put(lo, &dir);
 825
 826     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
 827              name, (unsigned long long)e->ino);
 828
 829     return 0;
 830
 831 out_err:
 832     saverr = errno;
 833     if (newfd != -1) {
 834         close(newfd);
 835     }
 836     lo_inode_put(lo, &inode);
 837     lo_inode_put(lo, &dir);
 838     return saverr;
 839 }
 840
 841 static void lo_lookup(fuse_req_t req, fuse_ino_t parent, const char *name)
 842 {
 843     struct fuse_entry_param e;
 844     int err;
 845
 846     fuse_log(FUSE_LOG_DEBUG, "lo_lookup(parent=%" PRIu64 ", name=%s)\n", parent,
 847              name);
 848
 849     /*
 850      * Don't use is_safe_path_component(), allow "." and ".." for NFS export
 851      * support.
 852      */
 853     if (strchr(name, '/')) {
 854         fuse_reply_err(req, EINVAL);
 855         return;
 856     }
 857
 858     err = lo_do_lookup(req, parent, name, &e);
 859     if (err) {
 860         fuse_reply_err(req, err);
 861     } else {
 862         fuse_reply_entry(req, &e);
 863     }
 864 }
 865
 866 /*
 867  * On some archs, setres*id is limited to 2^16 but they
 868  * provide setres*id32 variants that allow 2^32.
 869  * Others just let setres*id do 2^32 anyway.
 870  */
 871 #ifdef SYS_setresgid32
 872 #define OURSYS_setresgid SYS_setresgid32
 873 #else
 874 #define OURSYS_setresgid SYS_setresgid
 875 #endif
 876
 877 #ifdef SYS_setresuid32
 878 #define OURSYS_setresuid SYS_setresuid32
 879 #else
 880 #define OURSYS_setresuid SYS_setresuid
 881 #endif
 882
 883 /*
 884  * Change to uid/gid of caller so that file is created with
 885  * ownership of caller.
 886  * TODO: What about selinux context?
 887  */
 888 static int lo_change_cred(fuse_req_t req, struct lo_cred *old)
 889 {
 890     int res;
 891
 892     old->euid = geteuid();
 893     old->egid = getegid();
 894
 895     res = syscall(OURSYS_setresgid, -1, fuse_req_ctx(req)->gid, -1);
 896     if (res == -1) {
 897         return errno;
 898     }
 899
 900     res = syscall(OURSYS_setresuid, -1, fuse_req_ctx(req)->uid, -1);
 901     if (res == -1) {
 902         int errno_save = errno;
 903
 904         syscall(OURSYS_setresgid, -1, old->egid, -1);
 905         return errno_save;
 906     }
 907
 908     return 0;
 909 }
 910
 911 /* Regain Privileges */
 912 static void lo_restore_cred(struct lo_cred *old)
 913 {
 914     int res;
 915
 916     res = syscall(OURSYS_setresuid, -1, old->euid, -1);
 917     if (res == -1) {
 918         fuse_log(FUSE_LOG_ERR, "seteuid(%u): %m\n", old->euid);
 919         exit(1);
 920     }
 921
 922     res = syscall(OURSYS_setresgid, -1, old->egid, -1);
 923     if (res == -1) {
 924         fuse_log(FUSE_LOG_ERR, "setegid(%u): %m\n", old->egid);
 925         exit(1);
 926     }
 927 }
 928
 929 static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t parent,
 930                              const char *name, mode_t mode, dev_t rdev,
 931                              const char *link)
 932 {
 933     int res;
 934     int saverr;
 935     struct lo_data *lo = lo_data(req);
 936     struct lo_inode *dir;
 937     struct fuse_entry_param e;
 938     struct lo_cred old = {};
 939
 940     if (!is_safe_path_component(name)) {
 941         fuse_reply_err(req, EINVAL);
 942         return;
 943     }
 944
 945     dir = lo_inode(req, parent);
 946     if (!dir) {
 947         fuse_reply_err(req, EBADF);
 948         return;
 949     }
 950
 951     saverr = lo_change_cred(req, &old);
 952     if (saverr) {
 953         goto out;
 954     }
 955
 956     res = mknod_wrapper(dir->fd, name, link, mode, rdev);
 957
 958     saverr = errno;
 959
 960     lo_restore_cred(&old);
 961
 962     if (res == -1) {
 963         goto out;
 964     }
 965
 966     saverr = lo_do_lookup(req, parent, name, &e);
 967     if (saverr) {
 968         goto out;
 969     }
 970
 971     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
 972              name, (unsigned long long)e.ino);
 973
 974     fuse_reply_entry(req, &e);
 975     lo_inode_put(lo, &dir);
 976     return;
 977
 978 out:
 979     lo_inode_put(lo, &dir);
 980     fuse_reply_err(req, saverr);
 981 }
 982
 983 static void lo_mknod(fuse_req_t req, fuse_ino_t parent, const char *name,
 984                      mode_t mode, dev_t rdev)
 985 {
 986     lo_mknod_symlink(req, parent, name, mode, rdev, NULL);
 987 }
 988
 989 static void lo_mkdir(fuse_req_t req, fuse_ino_t parent, const char *name,
 990                      mode_t mode)
 991 {
 992     lo_mknod_symlink(req, parent, name, S_IFDIR | mode, 0, NULL);
 993 }
 994
 995 static void lo_symlink(fuse_req_t req, const char *link, fuse_ino_t parent,
 996                        const char *name)
 997 {
 998     lo_mknod_symlink(req, parent, name, S_IFLNK, 0, link);
 999 }
1000
1001 static void lo_link(fuse_req_t req, fuse_ino_t ino, fuse_ino_t parent,
1002                     const char *name)
1003 {
1004     int res;
1005     struct lo_data *lo = lo_data(req);
1006     struct lo_inode *parent_inode;
1007     struct lo_inode *inode;
1008     struct fuse_entry_param e;
1009     char procname[64];
1010     int saverr;
1011
1012     if (!is_safe_path_component(name)) {
1013         fuse_reply_err(req, EINVAL);
1014         return;
1015     }
1016
1017     parent_inode = lo_inode(req, parent);
1018     inode = lo_inode(req, ino);
1019     if (!parent_inode || !inode) {
1020         errno = EBADF;
1021         goto out_err;
1022     }
1023
1024     memset(&e, 0, sizeof(struct fuse_entry_param));
1025     e.attr_timeout = lo->timeout;
1026     e.entry_timeout = lo->timeout;
1027
1028     sprintf(procname, "%i", inode->fd);
1029     res = linkat(lo->proc_self_fd, procname, parent_inode->fd, name,
1030                  AT_SYMLINK_FOLLOW);
1031     if (res == -1) {
1032         goto out_err;
1033     }
1034
1035     res = fstatat(inode->fd, "", &e.attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1036     if (res == -1) {
1037         goto out_err;
1038     }
1039
1040     pthread_mutex_lock(&lo->mutex);
1041     inode->nlookup++;
1042     pthread_mutex_unlock(&lo->mutex);
1043     e.ino = inode->fuse_ino;
1044
1045     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
1046              name, (unsigned long long)e.ino);
1047
1048     fuse_reply_entry(req, &e);
1049     lo_inode_put(lo, &parent_inode);
1050     lo_inode_put(lo, &inode);
1051     return;
1052
1053 out_err:
1054     saverr = errno;
1055     lo_inode_put(lo, &parent_inode);
1056     lo_inode_put(lo, &inode);
1057     fuse_reply_err(req, saverr);
1058 }
1059
1060 /* Increments nlookup and caller must release refcount using lo_inode_put() */
1061 static struct lo_inode *lookup_name(fuse_req_t req, fuse_ino_t parent,
1062                                     const char *name)
1063 {
1064     int res;
1065     struct stat attr;
1066
1067     res = fstatat(lo_fd(req, parent), name, &attr,
1068                   AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1069     if (res == -1) {
1070         return NULL;
1071     }
1072
1073     return lo_find(lo_data(req), &attr);
1074 }
1075
1076 static void lo_rmdir(fuse_req_t req, fuse_ino_t parent, const char *name)
1077 {
1078     int res;
1079     struct lo_inode *inode;
1080     struct lo_data *lo = lo_data(req);
1081
1082     if (!is_safe_path_component(name)) {
1083         fuse_reply_err(req, EINVAL);
1084         return;
1085     }
1086
1087     inode = lookup_name(req, parent, name);
1088     if (!inode) {
1089         fuse_reply_err(req, EIO);
1090         return;
1091     }
1092
1093     res = unlinkat(lo_fd(req, parent), name, AT_REMOVEDIR);
1094
1095     fuse_reply_err(req, res == -1 ? errno : 0);
1096     unref_inode_lolocked(lo, inode, 1);
1097     lo_inode_put(lo, &inode);
1098 }
1099
1100 static void lo_rename(fuse_req_t req, fuse_ino_t parent, const char *name,
1101                       fuse_ino_t newparent, const char *newname,
1102                       unsigned int flags)
1103 {
1104     int res;
1105     struct lo_inode *parent_inode;
1106     struct lo_inode *newparent_inode;
1107     struct lo_inode *oldinode = NULL;
1108     struct lo_inode *newinode = NULL;
1109     struct lo_data *lo = lo_data(req);
1110
1111     if (!is_safe_path_component(name) || !is_safe_path_component(newname)) {
1112         fuse_reply_err(req, EINVAL);
1113         return;
1114     }
1115
1116     parent_inode = lo_inode(req, parent);
1117     newparent_inode = lo_inode(req, newparent);
1118     if (!parent_inode || !newparent_inode) {
1119         fuse_reply_err(req, EBADF);
1120         goto out;
1121     }
1122
1123     oldinode = lookup_name(req, parent, name);
1124     newinode = lookup_name(req, newparent, newname);
1125
1126     if (!oldinode) {
1127         fuse_reply_err(req, EIO);
1128         goto out;
1129     }
1130
1131     if (flags) {
1132 #ifndef SYS_renameat2
1133         fuse_reply_err(req, EINVAL);
1134 #else
1135         res = syscall(SYS_renameat2, parent_inode->fd, name,
1136                         newparent_inode->fd, newname, flags);
1137         if (res == -1 && errno == ENOSYS) {
1138             fuse_reply_err(req, EINVAL);
1139         } else {
1140             fuse_reply_err(req, res == -1 ? errno : 0);
1141         }
1142 #endif
1143         goto out;
1144     }
1145
1146     res = renameat(parent_inode->fd, name, newparent_inode->fd, newname);
1147
1148     fuse_reply_err(req, res == -1 ? errno : 0);
1149 out:
1150     unref_inode_lolocked(lo, oldinode, 1);
1151     unref_inode_lolocked(lo, newinode, 1);
1152     lo_inode_put(lo, &oldinode);
1153     lo_inode_put(lo, &newinode);
1154     lo_inode_put(lo, &parent_inode);
1155     lo_inode_put(lo, &newparent_inode);
1156 }
1157
1158 static void lo_unlink(fuse_req_t req, fuse_ino_t parent, const char *name)
1159 {
1160     int res;
1161     struct lo_inode *inode;
1162     struct lo_data *lo = lo_data(req);
1163
1164     if (!is_safe_path_component(name)) {
1165         fuse_reply_err(req, EINVAL);
1166         return;
1167     }
1168
1169     inode = lookup_name(req, parent, name);
1170     if (!inode) {
1171         fuse_reply_err(req, EIO);
1172         return;
1173     }
1174
1175     res = unlinkat(lo_fd(req, parent), name, 0);
1176
1177     fuse_reply_err(req, res == -1 ? errno : 0);
1178     unref_inode_lolocked(lo, inode, 1);
1179     lo_inode_put(lo, &inode);
1180 }
1181
1182 /* To be called with lo->mutex held */
1183 static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t n)
1184 {
1185     if (!inode) {
1186         return;
1187     }
1188
1189     assert(inode->nlookup >= n);
1190     inode->nlookup -= n;
1191     if (!inode->nlookup) {
1192         lo_map_remove(&lo->ino_map, inode->fuse_ino);
1193         g_hash_table_remove(lo->inodes, &inode->key);
1194         if (g_hash_table_size(inode->posix_locks)) {
1195             fuse_log(FUSE_LOG_WARNING, "Hash table is not empty\n");
1196         }
1197         g_hash_table_destroy(inode->posix_locks);
1198         pthread_mutex_destroy(&inode->plock_mutex);
1199
1200         /* Drop our refcount from lo_do_lookup() */
1201         lo_inode_put(lo, &inode);
1202     }
1203 }
1204
1205 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
1206                                  uint64_t n)
1207 {
1208     if (!inode) {
1209         return;
1210     }
1211
1212     pthread_mutex_lock(&lo->mutex);
1213     unref_inode(lo, inode, n);
1214     pthread_mutex_unlock(&lo->mutex);
1215 }
1216
1217 static void lo_forget_one(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1218 {
1219     struct lo_data *lo = lo_data(req);
1220     struct lo_inode *inode;
1221
1222     inode = lo_inode(req, ino);
1223     if (!inode) {
1224         return;
1225     }
1226
1227     fuse_log(FUSE_LOG_DEBUG, "  forget %lli %lli -%lli\n",
1228              (unsigned long long)ino, (unsigned long long)inode->nlookup,
1229              (unsigned long long)nlookup);
1230
1231     unref_inode_lolocked(lo, inode, nlookup);
1232     lo_inode_put(lo, &inode);
1233 }
1234
1235 static void lo_forget(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1236 {
1237     lo_forget_one(req, ino, nlookup);
1238     fuse_reply_none(req);
1239 }
1240
1241 static void lo_forget_multi(fuse_req_t req, size_t count,
1242                             struct fuse_forget_data *forgets)
1243 {
1244     int i;
1245
1246     for (i = 0; i < count; i++) {
1247         lo_forget_one(req, forgets[i].ino, forgets[i].nlookup);
1248     }
1249     fuse_reply_none(req);
1250 }
1251
1252 static void lo_readlink(fuse_req_t req, fuse_ino_t ino)
1253 {
1254     char buf[PATH_MAX + 1];
1255     int res;
1256
1257     res = readlinkat(lo_fd(req, ino), "", buf, sizeof(buf));
1258     if (res == -1) {
1259         return (void)fuse_reply_err(req, errno);
1260     }
1261
1262     if (res == sizeof(buf)) {
1263         return (void)fuse_reply_err(req, ENAMETOOLONG);
1264     }
1265
1266     buf[res] = '\0';
1267
1268     fuse_reply_readlink(req, buf);
1269 }
1270
1271 struct lo_dirp {
1272     gint refcount;
1273     DIR *dp;
1274     struct dirent *entry;
1275     off_t offset;
1276 };
1277
1278 static void lo_dirp_put(struct lo_dirp **dp)
1279 {
1280     struct lo_dirp *d = *dp;
1281
1282     if (!d) {
1283         return;
1284     }
1285     *dp = NULL;
1286
1287     if (g_atomic_int_dec_and_test(&d->refcount)) {
1288         closedir(d->dp);
1289         free(d);
1290     }
1291 }
1292
1293 /* Call lo_dirp_put() on the return value when no longer needed */
1294 static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
1295 {
1296     struct lo_data *lo = lo_data(req);
1297     struct lo_map_elem *elem;
1298
1299     pthread_mutex_lock(&lo->mutex);
1300     elem = lo_map_get(&lo->dirp_map, fi->fh);
1301     if (elem) {
1302         g_atomic_int_inc(&elem->dirp->refcount);
1303     }
1304     pthread_mutex_unlock(&lo->mutex);
1305     if (!elem) {
1306         return NULL;
1307     }
1308
1309     return elem->dirp;
1310 }
1311
1312 static void lo_opendir(fuse_req_t req, fuse_ino_t ino,
1313                        struct fuse_file_info *fi)
1314 {
1315     int error = ENOMEM;
1316     struct lo_data *lo = lo_data(req);
1317     struct lo_dirp *d;
1318     int fd;
1319     ssize_t fh;
1320
1321     d = calloc(1, sizeof(struct lo_dirp));
1322     if (d == NULL) {
1323         goto out_err;
1324     }
1325
1326     fd = openat(lo_fd(req, ino), ".", O_RDONLY);
1327     if (fd == -1) {
1328         goto out_errno;
1329     }
1330
1331     d->dp = fdopendir(fd);
1332     if (d->dp == NULL) {
1333         goto out_errno;
1334     }
1335
1336     d->offset = 0;
1337     d->entry = NULL;
1338
1339     g_atomic_int_set(&d->refcount, 1); /* paired with lo_releasedir() */
1340     pthread_mutex_lock(&lo->mutex);
1341     fh = lo_add_dirp_mapping(req, d);
1342     pthread_mutex_unlock(&lo->mutex);
1343     if (fh == -1) {
1344         goto out_err;
1345     }
1346
1347     fi->fh = fh;
1348     if (lo->cache == CACHE_ALWAYS) {
1349         fi->cache_readdir = 1;
1350     }
1351     fuse_reply_open(req, fi);
1352     return;
1353
1354 out_errno:
1355     error = errno;
1356 out_err:
1357     if (d) {
1358         if (d->dp) {
1359             closedir(d->dp);
1360         } else if (fd != -1) {
1361             close(fd);
1362         }
1363         free(d);
1364     }
1365     fuse_reply_err(req, error);
1366 }
1367
1368 static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1369                           off_t offset, struct fuse_file_info *fi, int plus)
1370 {
1371     struct lo_data *lo = lo_data(req);
1372     struct lo_dirp *d = NULL;
1373     struct lo_inode *dinode;
1374     char *buf = NULL;
1375     char *p;
1376     size_t rem = size;
1377     int err = EBADF;
1378
1379     dinode = lo_inode(req, ino);
1380     if (!dinode) {
1381         goto error;
1382     }
1383
1384     d = lo_dirp(req, fi);
1385     if (!d) {
1386         goto error;
1387     }
1388
1389     err = ENOMEM;
1390     buf = calloc(1, size);
1391     if (!buf) {
1392         goto error;
1393     }
1394     p = buf;
1395
1396     if (offset != d->offset) {
1397         seekdir(d->dp, offset);
1398         d->entry = NULL;
1399         d->offset = offset;
1400     }
1401     while (1) {
1402         size_t entsize;
1403         off_t nextoff;
1404         const char *name;
1405
1406         if (!d->entry) {
1407             errno = 0;
1408             d->entry = readdir(d->dp);
1409             if (!d->entry) {
1410                 if (errno) { /* Error */
1411                     err = errno;
1412                     goto error;
1413                 } else { /* End of stream */
1414                     break;
1415                 }
1416             }
1417         }
1418         nextoff = d->entry->d_off;
1419         name = d->entry->d_name;
1420
1421         fuse_ino_t entry_ino = 0;
1422         struct fuse_entry_param e = (struct fuse_entry_param){
1423             .attr.st_ino = d->entry->d_ino,
1424             .attr.st_mode = d->entry->d_type << 12,
1425         };
1426
1427         /* Hide root's parent directory */
1428         if (dinode == &lo->root && strcmp(name, "..") == 0) {
1429             e.attr.st_ino = lo->root.key.ino;
1430             e.attr.st_mode = DT_DIR << 12;
1431         }
1432
1433         if (plus) {
1434             if (!is_dot_or_dotdot(name)) {
1435                 err = lo_do_lookup(req, ino, name, &e);
1436                 if (err) {
1437                     goto error;
1438                 }
1439                 entry_ino = e.ino;
1440             }
1441
1442             entsize = fuse_add_direntry_plus(req, p, rem, name, &e, nextoff);
1443         } else {
1444             entsize = fuse_add_direntry(req, p, rem, name, &e.attr, nextoff);
1445         }
1446         if (entsize > rem) {
1447             if (entry_ino != 0) {
1448                 lo_forget_one(req, entry_ino, 1);
1449             }
1450             break;
1451         }
1452
1453         p += entsize;
1454         rem -= entsize;
1455
1456         d->entry = NULL;
1457         d->offset = nextoff;
1458     }
1459
1460     err = 0;
1461 error:
1462     lo_dirp_put(&d);
1463     lo_inode_put(lo, &dinode);
1464
1465     /*
1466      * If there's an error, we can only signal it if we haven't stored
1467      * any entries yet - otherwise we'd end up with wrong lookup
1468      * counts for the entries that are already in the buffer. So we
1469      * return what we've collected until that point.
1470      */
1471     if (err && rem == size) {
1472         fuse_reply_err(req, err);
1473     } else {
1474         fuse_reply_buf(req, buf, size - rem);
1475     }
1476     free(buf);
1477 }
1478
1479 static void lo_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1480                        off_t offset, struct fuse_file_info *fi)
1481 {
1482     lo_do_readdir(req, ino, size, offset, fi, 0);
1483 }
1484
1485 static void lo_readdirplus(fuse_req_t req, fuse_ino_t ino, size_t size,
1486                            off_t offset, struct fuse_file_info *fi)
1487 {
1488     lo_do_readdir(req, ino, size, offset, fi, 1);
1489 }
1490
1491 static void lo_releasedir(fuse_req_t req, fuse_ino_t ino,
1492                           struct fuse_file_info *fi)
1493 {
1494     struct lo_data *lo = lo_data(req);
1495     struct lo_map_elem *elem;
1496     struct lo_dirp *d;
1497
1498     (void)ino;
1499
1500     pthread_mutex_lock(&lo->mutex);
1501     elem = lo_map_get(&lo->dirp_map, fi->fh);
1502     if (!elem) {
1503         pthread_mutex_unlock(&lo->mutex);
1504         fuse_reply_err(req, EBADF);
1505         return;
1506     }
1507
1508     d = elem->dirp;
1509     lo_map_remove(&lo->dirp_map, fi->fh);
1510     pthread_mutex_unlock(&lo->mutex);
1511
1512     lo_dirp_put(&d); /* paired with lo_opendir() */
1513
1514     fuse_reply_err(req, 0);
1515 }
1516
1517 static void update_open_flags(int writeback, struct fuse_file_info *fi)
1518 {
1519     /*
1520      * With writeback cache, kernel may send read requests even
1521      * when userspace opened write-only
1522      */
1523     if (writeback && (fi->flags & O_ACCMODE) == O_WRONLY) {
1524         fi->flags &= ~O_ACCMODE;
1525         fi->flags |= O_RDWR;
1526     }
1527
1528     /*
1529      * With writeback cache, O_APPEND is handled by the kernel.
1530      * This breaks atomicity (since the file may change in the
1531      * underlying filesystem, so that the kernel's idea of the
1532      * end of the file isn't accurate anymore). In this example,
1533      * we just accept that. A more rigorous filesystem may want
1534      * to return an error here
1535      */
1536     if (writeback && (fi->flags & O_APPEND)) {
1537         fi->flags &= ~O_APPEND;
1538     }
1539
1540     /*
1541      * O_DIRECT in guest should not necessarily mean bypassing page
1542      * cache on host as well. If somebody needs that behavior, it
1543      * probably should be a configuration knob in daemon.
1544      */
1545     fi->flags &= ~O_DIRECT;
1546 }
1547
1548 static void lo_create(fuse_req_t req, fuse_ino_t parent, const char *name,
1549                       mode_t mode, struct fuse_file_info *fi)
1550 {
1551     int fd;
1552     struct lo_data *lo = lo_data(req);
1553     struct lo_inode *parent_inode;
1554     struct fuse_entry_param e;
1555     int err;
1556     struct lo_cred old = {};
1557
1558     fuse_log(FUSE_LOG_DEBUG, "lo_create(parent=%" PRIu64 ", name=%s)\n", parent,
1559              name);
1560
1561     if (!is_safe_path_component(name)) {
1562         fuse_reply_err(req, EINVAL);
1563         return;
1564     }
1565
1566     parent_inode = lo_inode(req, parent);
1567     if (!parent_inode) {
1568         fuse_reply_err(req, EBADF);
1569         return;
1570     }
1571
1572     err = lo_change_cred(req, &old);
1573     if (err) {
1574         goto out;
1575     }
1576
1577     update_open_flags(lo->writeback, fi);
1578
1579     fd = openat(parent_inode->fd, name, (fi->flags | O_CREAT) & ~O_NOFOLLOW,
1580                 mode);
1581     err = fd == -1 ? errno : 0;
1582     lo_restore_cred(&old);
1583
1584     if (!err) {
1585         ssize_t fh;
1586
1587         pthread_mutex_lock(&lo->mutex);
1588         fh = lo_add_fd_mapping(req, fd);
1589         pthread_mutex_unlock(&lo->mutex);
1590         if (fh == -1) {
1591             close(fd);
1592             err = ENOMEM;
1593             goto out;
1594         }
1595
1596         fi->fh = fh;
1597         err = lo_do_lookup(req, parent, name, &e);
1598     }
1599     if (lo->cache == CACHE_NONE) {
1600         fi->direct_io = 1;
1601     } else if (lo->cache == CACHE_ALWAYS) {
1602         fi->keep_cache = 1;
1603     }
1604
1605 out:
1606     lo_inode_put(lo, &parent_inode);
1607
1608     if (err) {
1609         fuse_reply_err(req, err);
1610     } else {
1611         fuse_reply_create(req, &e, fi);
1612     }
1613 }
1614
1615 /* Should be called with inode->plock_mutex held */
1616 static struct lo_inode_plock *lookup_create_plock_ctx(struct lo_data *lo,
1617                                                       struct lo_inode *inode,
1618                                                       uint64_t lock_owner,
1619                                                       pid_t pid, int *err)
1620 {
1621     struct lo_inode_plock *plock;
1622     char procname[64];
1623     int fd;
1624
1625     plock =
1626         g_hash_table_lookup(inode->posix_locks, GUINT_TO_POINTER(lock_owner));
1627
1628     if (plock) {
1629         return plock;
1630     }
1631
1632     plock = malloc(sizeof(struct lo_inode_plock));
1633     if (!plock) {
1634         *err = ENOMEM;
1635         return NULL;
1636     }
1637
1638     /* Open another instance of file which can be used for ofd locks. */
1639     sprintf(procname, "%i", inode->fd);
1640
1641     /* TODO: What if file is not writable? */
1642     fd = openat(lo->proc_self_fd, procname, O_RDWR);
1643     if (fd == -1) {
1644         *err = errno;
1645         free(plock);
1646         return NULL;
1647     }
1648
1649     plock->lock_owner = lock_owner;
1650     plock->fd = fd;
1651     g_hash_table_insert(inode->posix_locks, GUINT_TO_POINTER(plock->lock_owner),
1652                         plock);
1653     return plock;
1654 }
1655
1656 static void lo_getlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1657                      struct flock *lock)
1658 {
1659     struct lo_data *lo = lo_data(req);
1660     struct lo_inode *inode;
1661     struct lo_inode_plock *plock;
1662     int ret, saverr = 0;
1663
1664     fuse_log(FUSE_LOG_DEBUG,
1665              "lo_getlk(ino=%" PRIu64 ", flags=%d)"
1666              " owner=0x%lx, l_type=%d l_start=0x%lx"
1667              " l_len=0x%lx\n",
1668              ino, fi->flags, fi->lock_owner, lock->l_type, lock->l_start,
1669              lock->l_len);
1670
1671     inode = lo_inode(req, ino);
1672     if (!inode) {
1673         fuse_reply_err(req, EBADF);
1674         return;
1675     }
1676
1677     pthread_mutex_lock(&inode->plock_mutex);
1678     plock =
1679         lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1680     if (!plock) {
1681         saverr = ret;
1682         goto out;
1683     }
1684
1685     ret = fcntl(plock->fd, F_OFD_GETLK, lock);
1686     if (ret == -1) {
1687         saverr = errno;
1688     }
1689
1690 out:
1691     pthread_mutex_unlock(&inode->plock_mutex);
1692     lo_inode_put(lo, &inode);
1693
1694     if (saverr) {
1695         fuse_reply_err(req, saverr);
1696     } else {
1697         fuse_reply_lock(req, lock);
1698     }
1699 }
1700
1701 static void lo_setlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1702                      struct flock *lock, int sleep)
1703 {
1704     struct lo_data *lo = lo_data(req);
1705     struct lo_inode *inode;
1706     struct lo_inode_plock *plock;
1707     int ret, saverr = 0;
1708
1709     fuse_log(FUSE_LOG_DEBUG,
1710              "lo_setlk(ino=%" PRIu64 ", flags=%d)"
1711              " cmd=%d pid=%d owner=0x%lx sleep=%d l_whence=%d"
1712              " l_start=0x%lx l_len=0x%lx\n",
1713              ino, fi->flags, lock->l_type, lock->l_pid, fi->lock_owner, sleep,
1714              lock->l_whence, lock->l_start, lock->l_len);
1715
1716     if (sleep) {
1717         fuse_reply_err(req, EOPNOTSUPP);
1718         return;
1719     }
1720
1721     inode = lo_inode(req, ino);
1722     if (!inode) {
1723         fuse_reply_err(req, EBADF);
1724         return;
1725     }
1726
1727     pthread_mutex_lock(&inode->plock_mutex);
1728     plock =
1729         lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1730
1731     if (!plock) {
1732         saverr = ret;
1733         goto out;
1734     }
1735
1736     /* TODO: Is it alright to modify flock? */
1737     lock->l_pid = 0;
1738     ret = fcntl(plock->fd, F_OFD_SETLK, lock);
1739     if (ret == -1) {
1740         saverr = errno;
1741     }
1742
1743 out:
1744     pthread_mutex_unlock(&inode->plock_mutex);
1745     lo_inode_put(lo, &inode);
1746
1747     fuse_reply_err(req, saverr);
1748 }
1749
1750 static void lo_fsyncdir(fuse_req_t req, fuse_ino_t ino, int datasync,
1751                         struct fuse_file_info *fi)
1752 {
1753     int res;
1754     struct lo_dirp *d;
1755     int fd;
1756
1757     (void)ino;
1758
1759     d = lo_dirp(req, fi);
1760     if (!d) {
1761         fuse_reply_err(req, EBADF);
1762         return;
1763     }
1764
1765     fd = dirfd(d->dp);
1766     if (datasync) {
1767         res = fdatasync(fd);
1768     } else {
1769         res = fsync(fd);
1770     }
1771
1772     lo_dirp_put(&d);
1773
1774     fuse_reply_err(req, res == -1 ? errno : 0);
1775 }
1776
1777 static void lo_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1778 {
1779     int fd;
1780     ssize_t fh;
1781     char buf[64];
1782     struct lo_data *lo = lo_data(req);
1783
1784     fuse_log(FUSE_LOG_DEBUG, "lo_open(ino=%" PRIu64 ", flags=%d)\n", ino,
1785              fi->flags);
1786
1787     update_open_flags(lo->writeback, fi);
1788
1789     sprintf(buf, "%i", lo_fd(req, ino));
1790     fd = openat(lo->proc_self_fd, buf, fi->flags & ~O_NOFOLLOW);
1791     if (fd == -1) {
1792         return (void)fuse_reply_err(req, errno);
1793     }
1794
1795     pthread_mutex_lock(&lo->mutex);
1796     fh = lo_add_fd_mapping(req, fd);
1797     pthread_mutex_unlock(&lo->mutex);
1798     if (fh == -1) {
1799         close(fd);
1800         fuse_reply_err(req, ENOMEM);
1801         return;
1802     }
1803
1804     fi->fh = fh;
1805     if (lo->cache == CACHE_NONE) {
1806         fi->direct_io = 1;
1807     } else if (lo->cache == CACHE_ALWAYS) {
1808         fi->keep_cache = 1;
1809     }
1810     fuse_reply_open(req, fi);
1811 }
1812
1813 static void lo_release(fuse_req_t req, fuse_ino_t ino,
1814                        struct fuse_file_info *fi)
1815 {
1816     struct lo_data *lo = lo_data(req);
1817     struct lo_map_elem *elem;
1818     int fd = -1;
1819
1820     (void)ino;
1821
1822     pthread_mutex_lock(&lo->mutex);
1823     elem = lo_map_get(&lo->fd_map, fi->fh);
1824     if (elem) {
1825         fd = elem->fd;
1826         elem = NULL;
1827         lo_map_remove(&lo->fd_map, fi->fh);
1828     }
1829     pthread_mutex_unlock(&lo->mutex);
1830
1831     close(fd);
1832     fuse_reply_err(req, 0);
1833 }
1834
1835 static void lo_flush(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1836 {
1837     int res;
1838     (void)ino;
1839     struct lo_inode *inode;
1840
1841     inode = lo_inode(req, ino);
1842     if (!inode) {
1843         fuse_reply_err(req, EBADF);
1844         return;
1845     }
1846
1847     /* An fd is going away. Cleanup associated posix locks */
1848     pthread_mutex_lock(&inode->plock_mutex);
1849     g_hash_table_remove(inode->posix_locks, GUINT_TO_POINTER(fi->lock_owner));
1850     pthread_mutex_unlock(&inode->plock_mutex);
1851
1852     res = close(dup(lo_fi_fd(req, fi)));
1853     lo_inode_put(lo_data(req), &inode);
1854     fuse_reply_err(req, res == -1 ? errno : 0);
1855 }
1856
1857 static void lo_fsync(fuse_req_t req, fuse_ino_t ino, int datasync,
1858                      struct fuse_file_info *fi)
1859 {
1860     int res;
1861     int fd;
1862     char *buf;
1863
1864     fuse_log(FUSE_LOG_DEBUG, "lo_fsync(ino=%" PRIu64 ", fi=0x%p)\n", ino,
1865              (void *)fi);
1866
1867     if (!fi) {
1868         struct lo_data *lo = lo_data(req);
1869
1870         res = asprintf(&buf, "%i", lo_fd(req, ino));
1871         if (res == -1) {
1872             return (void)fuse_reply_err(req, errno);
1873         }
1874
1875         fd = openat(lo->proc_self_fd, buf, O_RDWR);
1876         free(buf);
1877         if (fd == -1) {
1878             return (void)fuse_reply_err(req, errno);
1879         }
1880     } else {
1881         fd = lo_fi_fd(req, fi);
1882     }
1883
1884     if (datasync) {
1885         res = fdatasync(fd);
1886     } else {
1887         res = fsync(fd);
1888     }
1889     if (!fi) {
1890         close(fd);
1891     }
1892     fuse_reply_err(req, res == -1 ? errno : 0);
1893 }
1894
1895 static void lo_read(fuse_req_t req, fuse_ino_t ino, size_t size, off_t offset,
1896                     struct fuse_file_info *fi)
1897 {
1898     struct fuse_bufvec buf = FUSE_BUFVEC_INIT(size);
1899
1900     fuse_log(FUSE_LOG_DEBUG,
1901              "lo_read(ino=%" PRIu64 ", size=%zd, "
1902              "off=%lu)\n",
1903              ino, size, (unsigned long)offset);
1904
1905     buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
1906     buf.buf[0].fd = lo_fi_fd(req, fi);
1907     buf.buf[0].pos = offset;
1908
1909     fuse_reply_data(req, &buf);
1910 }
1911
1912 static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
1913                          struct fuse_bufvec *in_buf, off_t off,
1914                          struct fuse_file_info *fi)
1915 {
1916     (void)ino;
1917     ssize_t res;
1918     struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
1919     bool cap_fsetid_dropped = false;
1920
1921     out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
1922     out_buf.buf[0].fd = lo_fi_fd(req, fi);
1923     out_buf.buf[0].pos = off;
1924
1925     fuse_log(FUSE_LOG_DEBUG,
1926              "lo_write_buf(ino=%" PRIu64 ", size=%zd, off=%lu)\n", ino,
1927              out_buf.buf[0].size, (unsigned long)off);
1928
1929     /*
1930      * If kill_priv is set, drop CAP_FSETID which should lead to kernel
1931      * clearing setuid/setgid on file.
1932      */
1933     if (fi->kill_priv) {
1934         res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
1935         if (res != 0) {
1936             fuse_reply_err(req, res);
1937             return;
1938         }
1939     }
1940
1941     res = fuse_buf_copy(&out_buf, in_buf);
1942     if (res < 0) {
1943         fuse_reply_err(req, -res);
1944     } else {
1945         fuse_reply_write(req, (size_t)res);
1946     }
1947
1948     if (cap_fsetid_dropped) {
1949         res = gain_effective_cap("FSETID");
1950         if (res) {
1951             fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
1952         }
1953     }
1954 }
1955
1956 static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
1957 {
1958     int res;
1959     struct statvfs stbuf;
1960
1961     res = fstatvfs(lo_fd(req, ino), &stbuf);
1962     if (res == -1) {
1963         fuse_reply_err(req, errno);
1964     } else {
1965         fuse_reply_statfs(req, &stbuf);
1966     }
1967 }
1968
1969 static void lo_fallocate(fuse_req_t req, fuse_ino_t ino, int mode, off_t offset,
1970                          off_t length, struct fuse_file_info *fi)
1971 {
1972     int err = EOPNOTSUPP;
1973     (void)ino;
1974
1975 #ifdef CONFIG_FALLOCATE
1976     err = fallocate(lo_fi_fd(req, fi), mode, offset, length);
1977     if (err < 0) {
1978         err = errno;
1979     }
1980
1981 #elif defined(CONFIG_POSIX_FALLOCATE)
1982     if (mode) {
1983         fuse_reply_err(req, EOPNOTSUPP);
1984         return;
1985     }
1986
1987     err = posix_fallocate(lo_fi_fd(req, fi), offset, length);
1988 #endif
1989
1990     fuse_reply_err(req, err);
1991 }
1992
1993 static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1994                      int op)
1995 {
1996     int res;
1997     (void)ino;
1998
1999     res = flock(lo_fi_fd(req, fi), op);
2000
2001     fuse_reply_err(req, res == -1 ? errno : 0);
2002 }
2003
2004 static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2005                         size_t size)
2006 {
2007     struct lo_data *lo = lo_data(req);
2008     char *value = NULL;
2009     char procname[64];
2010     struct lo_inode *inode;
2011     ssize_t ret;
2012     int saverr;
2013     int fd = -1;
2014
2015     inode = lo_inode(req, ino);
2016     if (!inode) {
2017         fuse_reply_err(req, EBADF);
2018         return;
2019     }
2020
2021     saverr = ENOSYS;
2022     if (!lo_data(req)->xattr) {
2023         goto out;
2024     }
2025
2026     fuse_log(FUSE_LOG_DEBUG, "lo_getxattr(ino=%" PRIu64 ", name=%s size=%zd)\n",
2027              ino, name, size);
2028
2029     if (size) {
2030         value = malloc(size);
2031         if (!value) {
2032             goto out_err;
2033         }
2034     }
2035
2036     sprintf(procname, "%i", inode->fd);
2037     /*
2038      * It is not safe to open() non-regular/non-dir files in file server
2039      * unless O_PATH is used, so use that method for regular files/dir
2040      * only (as it seems giving less performance overhead).
2041      * Otherwise, call fchdir() to avoid open().
2042      */
2043     if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2044         fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2045         if (fd < 0) {
2046             goto out_err;
2047         }
2048         ret = fgetxattr(fd, name, value, size);
2049     } else {
2050         /* fchdir should not fail here */
2051         assert(fchdir(lo->proc_self_fd) == 0);
2052         ret = getxattr(procname, name, value, size);
2053         assert(fchdir(lo->root.fd) == 0);
2054     }
2055
2056     if (ret == -1) {
2057         goto out_err;
2058     }
2059     if (size) {
2060         saverr = 0;
2061         if (ret == 0) {
2062             goto out;
2063         }
2064         fuse_reply_buf(req, value, ret);
2065     } else {
2066         fuse_reply_xattr(req, ret);
2067     }
2068 out_free:
2069     free(value);
2070
2071     if (fd >= 0) {
2072         close(fd);
2073     }
2074
2075     lo_inode_put(lo, &inode);
2076     return;
2077
2078 out_err:
2079     saverr = errno;
2080 out:
2081     fuse_reply_err(req, saverr);
2082     goto out_free;
2083 }
2084
2085 static void lo_listxattr(fuse_req_t req, fuse_ino_t ino, size_t size)
2086 {
2087     struct lo_data *lo = lo_data(req);
2088     char *value = NULL;
2089     char procname[64];
2090     struct lo_inode *inode;
2091     ssize_t ret;
2092     int saverr;
2093     int fd = -1;
2094
2095     inode = lo_inode(req, ino);
2096     if (!inode) {
2097         fuse_reply_err(req, EBADF);
2098         return;
2099     }
2100
2101     saverr = ENOSYS;
2102     if (!lo_data(req)->xattr) {
2103         goto out;
2104     }
2105
2106     fuse_log(FUSE_LOG_DEBUG, "lo_listxattr(ino=%" PRIu64 ", size=%zd)\n", ino,
2107              size);
2108
2109     if (size) {
2110         value = malloc(size);
2111         if (!value) {
2112             goto out_err;
2113         }
2114     }
2115
2116     sprintf(procname, "%i", inode->fd);
2117     if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2118         fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2119         if (fd < 0) {
2120             goto out_err;
2121         }
2122         ret = flistxattr(fd, value, size);
2123     } else {
2124         /* fchdir should not fail here */
2125         assert(fchdir(lo->proc_self_fd) == 0);
2126         ret = listxattr(procname, value, size);
2127         assert(fchdir(lo->root.fd) == 0);
2128     }
2129
2130     if (ret == -1) {
2131         goto out_err;
2132     }
2133     if (size) {
2134         saverr = 0;
2135         if (ret == 0) {
2136             goto out;
2137         }
2138         fuse_reply_buf(req, value, ret);
2139     } else {
2140         fuse_reply_xattr(req, ret);
2141     }
2142 out_free:
2143     free(value);
2144
2145     if (fd >= 0) {
2146         close(fd);
2147     }
2148
2149     lo_inode_put(lo, &inode);
2150     return;
2151
2152 out_err:
2153     saverr = errno;
2154 out:
2155     fuse_reply_err(req, saverr);
2156     goto out_free;
2157 }
2158
2159 static void lo_setxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2160                         const char *value, size_t size, int flags)
2161 {
2162     char procname[64];
2163     struct lo_data *lo = lo_data(req);
2164     struct lo_inode *inode;
2165     ssize_t ret;
2166     int saverr;
2167     int fd = -1;
2168
2169     inode = lo_inode(req, ino);
2170     if (!inode) {
2171         fuse_reply_err(req, EBADF);
2172         return;
2173     }
2174
2175     saverr = ENOSYS;
2176     if (!lo_data(req)->xattr) {
2177         goto out;
2178     }
2179
2180     fuse_log(FUSE_LOG_DEBUG, "lo_setxattr(ino=%" PRIu64
2181              ", name=%s value=%s size=%zd)\n", ino, name, value, size);
2182
2183     sprintf(procname, "%i", inode->fd);
2184     if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2185         fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2186         if (fd < 0) {
2187             saverr = errno;
2188             goto out;
2189         }
2190         ret = fsetxattr(fd, name, value, size, flags);
2191     } else {
2192         /* fchdir should not fail here */
2193         assert(fchdir(lo->proc_self_fd) == 0);
2194         ret = setxattr(procname, name, value, size, flags);
2195         assert(fchdir(lo->root.fd) == 0);
2196     }
2197
2198     saverr = ret == -1 ? errno : 0;
2199
2200 out:
2201     if (fd >= 0) {
2202         close(fd);
2203     }
2204
2205     lo_inode_put(lo, &inode);
2206     fuse_reply_err(req, saverr);
2207 }
2208
2209 static void lo_removexattr(fuse_req_t req, fuse_ino_t ino, const char *name)
2210 {
2211     char procname[64];
2212     struct lo_data *lo = lo_data(req);
2213     struct lo_inode *inode;
2214     ssize_t ret;
2215     int saverr;
2216     int fd = -1;
2217
2218     inode = lo_inode(req, ino);
2219     if (!inode) {
2220         fuse_reply_err(req, EBADF);
2221         return;
2222     }
2223
2224     saverr = ENOSYS;
2225     if (!lo_data(req)->xattr) {
2226         goto out;
2227     }
2228
2229     fuse_log(FUSE_LOG_DEBUG, "lo_removexattr(ino=%" PRIu64 ", name=%s)\n", ino,
2230              name);
2231
2232     sprintf(procname, "%i", inode->fd);
2233     if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2234         fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2235         if (fd < 0) {
2236             saverr = errno;
2237             goto out;
2238         }
2239         ret = fremovexattr(fd, name);
2240     } else {
2241         /* fchdir should not fail here */
2242         assert(fchdir(lo->proc_self_fd) == 0);
2243         ret = removexattr(procname, name);
2244         assert(fchdir(lo->root.fd) == 0);
2245     }
2246
2247     saverr = ret == -1 ? errno : 0;
2248
2249 out:
2250     if (fd >= 0) {
2251         close(fd);
2252     }
2253
2254     lo_inode_put(lo, &inode);
2255     fuse_reply_err(req, saverr);
2256 }
2257
2258 #ifdef HAVE_COPY_FILE_RANGE
2259 static void lo_copy_file_range(fuse_req_t req, fuse_ino_t ino_in, off_t off_in,
2260                                struct fuse_file_info *fi_in, fuse_ino_t ino_out,
2261                                off_t off_out, struct fuse_file_info *fi_out,
2262                                size_t len, int flags)
2263 {
2264     int in_fd, out_fd;
2265     ssize_t res;
2266
2267     in_fd = lo_fi_fd(req, fi_in);
2268     out_fd = lo_fi_fd(req, fi_out);
2269
2270     fuse_log(FUSE_LOG_DEBUG,
2271              "lo_copy_file_range(ino=%" PRIu64 "/fd=%d, "
2272              "off=%lu, ino=%" PRIu64 "/fd=%d, "
2273              "off=%lu, size=%zd, flags=0x%x)\n",
2274              ino_in, in_fd, off_in, ino_out, out_fd, off_out, len, flags);
2275
2276     res = copy_file_range(in_fd, &off_in, out_fd, &off_out, len, flags);
2277     if (res < 0) {
2278         fuse_reply_err(req, errno);
2279     } else {
2280         fuse_reply_write(req, res);
2281     }
2282 }
2283 #endif
2284
2285 static void lo_lseek(fuse_req_t req, fuse_ino_t ino, off_t off, int whence,
2286                      struct fuse_file_info *fi)
2287 {
2288     off_t res;
2289
2290     (void)ino;
2291     res = lseek(lo_fi_fd(req, fi), off, whence);
2292     if (res != -1) {
2293         fuse_reply_lseek(req, res);
2294     } else {
2295         fuse_reply_err(req, errno);
2296     }
2297 }
2298
2299 static void lo_destroy(void *userdata)
2300 {
2301     struct lo_data *lo = (struct lo_data *)userdata;
2302
2303     pthread_mutex_lock(&lo->mutex);
2304     while (true) {
2305         GHashTableIter iter;
2306         gpointer key, value;
2307
2308         g_hash_table_iter_init(&iter, lo->inodes);
2309         if (!g_hash_table_iter_next(&iter, &key, &value)) {
2310             break;
2311         }
2312
2313         struct lo_inode *inode = value;
2314         unref_inode(lo, inode, inode->nlookup);
2315     }
2316     pthread_mutex_unlock(&lo->mutex);
2317 }
2318
2319 static struct fuse_lowlevel_ops lo_oper = {
2320     .init = lo_init,
2321     .lookup = lo_lookup,
2322     .mkdir = lo_mkdir,
2323     .mknod = lo_mknod,
2324     .symlink = lo_symlink,
2325     .link = lo_link,
2326     .unlink = lo_unlink,
2327     .rmdir = lo_rmdir,
2328     .rename = lo_rename,
2329     .forget = lo_forget,
2330     .forget_multi = lo_forget_multi,
2331     .getattr = lo_getattr,
2332     .setattr = lo_setattr,
2333     .readlink = lo_readlink,
2334     .opendir = lo_opendir,
2335     .readdir = lo_readdir,
2336     .readdirplus = lo_readdirplus,
2337     .releasedir = lo_releasedir,
2338     .fsyncdir = lo_fsyncdir,
2339     .create = lo_create,
2340     .getlk = lo_getlk,
2341     .setlk = lo_setlk,
2342     .open = lo_open,
2343     .release = lo_release,
2344     .flush = lo_flush,
2345     .fsync = lo_fsync,
2346     .read = lo_read,
2347     .write_buf = lo_write_buf,
2348     .statfs = lo_statfs,
2349     .fallocate = lo_fallocate,
2350     .flock = lo_flock,
2351     .getxattr = lo_getxattr,
2352     .listxattr = lo_listxattr,
2353     .setxattr = lo_setxattr,
2354     .removexattr = lo_removexattr,
2355 #ifdef HAVE_COPY_FILE_RANGE
2356     .copy_file_range = lo_copy_file_range,
2357 #endif
2358     .lseek = lo_lseek,
2359     .destroy = lo_destroy,
2360 };
2361
2362 /* Print vhost-user.json backend program capabilities */
2363 static void print_capabilities(void)
2364 {
2365     printf("{\n");
2366     printf("  \"type\": \"fs\"\n");
2367     printf("}\n");
2368 }
2369
2370 /*
2371  * Drop all Linux capabilities because the wait parent process only needs to
2372  * sit in waitpid(2) and terminate.
2373  */
2374 static void setup_wait_parent_capabilities(void)
2375 {
2376     capng_setpid(syscall(SYS_gettid));
2377     capng_clear(CAPNG_SELECT_BOTH);
2378     capng_apply(CAPNG_SELECT_BOTH);
2379 }
2380
2381 /*
2382  * Move to a new mount, net, and pid namespaces to isolate this process.
2383  */
2384 static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
2385 {
2386     pid_t child;
2387     char template[] = "virtiofsd-XXXXXX";
2388     char *tmpdir;
2389
2390     /*
2391      * Create a new pid namespace for *child* processes.  We'll have to
2392      * fork in order to enter the new pid namespace.  A new mount namespace
2393      * is also needed so that we can remount /proc for the new pid
2394      * namespace.
2395      *
2396      * Our UNIX domain sockets have been created.  Now we can move to
2397      * an empty network namespace to prevent TCP/IP and other network
2398      * activity in case this process is compromised.
2399      */
2400     if (unshare(CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWNET) != 0) {
2401         fuse_log(FUSE_LOG_ERR, "unshare(CLONE_NEWPID | CLONE_NEWNS): %m\n");
2402         exit(1);
2403     }
2404
2405     child = fork();
2406     if (child < 0) {
2407         fuse_log(FUSE_LOG_ERR, "fork() failed: %m\n");
2408         exit(1);
2409     }
2410     if (child > 0) {
2411         pid_t waited;
2412         int wstatus;
2413
2414         setup_wait_parent_capabilities();
2415
2416         /* The parent waits for the child */
2417         do {
2418             waited = waitpid(child, &wstatus, 0);
2419         } while (waited < 0 && errno == EINTR && !se->exited);
2420
2421         /* We were terminated by a signal, see fuse_signals.c */
2422         if (se->exited) {
2423             exit(0);
2424         }
2425
2426         if (WIFEXITED(wstatus)) {
2427             exit(WEXITSTATUS(wstatus));
2428         }
2429
2430         exit(1);
2431     }
2432
2433     /* Send us SIGTERM when the parent thread terminates, see prctl(2) */
2434     prctl(PR_SET_PDEATHSIG, SIGTERM);
2435
2436     /*
2437      * If the mounts have shared propagation then we want to opt out so our
2438      * mount changes don't affect the parent mount namespace.
2439      */
2440     if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0) {
2441         fuse_log(FUSE_LOG_ERR, "mount(/, MS_REC|MS_SLAVE): %m\n");
2442         exit(1);
2443     }
2444
2445     /* The child must remount /proc to use the new pid namespace */
2446     if (mount("proc", "/proc", "proc",
2447               MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RELATIME, NULL) < 0) {
2448         fuse_log(FUSE_LOG_ERR, "mount(/proc): %m\n");
2449         exit(1);
2450     }
2451
2452     tmpdir = mkdtemp(template);
2453     if (!tmpdir) {
2454         fuse_log(FUSE_LOG_ERR, "tmpdir(%s): %m\n", template);
2455         exit(1);
2456     }
2457
2458     if (mount("/proc/self/fd", tmpdir, NULL, MS_BIND, NULL) < 0) {
2459         fuse_log(FUSE_LOG_ERR, "mount(/proc/self/fd, %s, MS_BIND): %m\n",
2460                  tmpdir);
2461         exit(1);
2462     }
2463
2464     /* Now we can get our /proc/self/fd directory file descriptor */
2465     lo->proc_self_fd = open(tmpdir, O_PATH);
2466     if (lo->proc_self_fd == -1) {
2467         fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", tmpdir);
2468         exit(1);
2469     }
2470
2471     if (umount2(tmpdir, MNT_DETACH) < 0) {
2472         fuse_log(FUSE_LOG_ERR, "umount2(%s, MNT_DETACH): %m\n", tmpdir);
2473         exit(1);
2474     }
2475
2476     if (rmdir(tmpdir) < 0) {
2477         fuse_log(FUSE_LOG_ERR, "rmdir(%s): %m\n", tmpdir);
2478     }
2479 }
2480
2481 /*
2482  * Capture the capability state, we'll need to restore this for individual
2483  * threads later; see load_capng.
2484  */
2485 static void setup_capng(void)
2486 {
2487     /* Note this accesses /proc so has to happen before the sandbox */
2488     if (capng_get_caps_process()) {
2489         fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
2490         exit(1);
2491     }
2492     pthread_mutex_init(&cap.mutex, NULL);
2493     pthread_mutex_lock(&cap.mutex);
2494     cap.saved = capng_save_state();
2495     if (!cap.saved) {
2496         fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
2497         exit(1);
2498     }
2499     pthread_mutex_unlock(&cap.mutex);
2500 }
2501
2502 static void cleanup_capng(void)
2503 {
2504     free(cap.saved);
2505     cap.saved = NULL;
2506     pthread_mutex_destroy(&cap.mutex);
2507 }
2508
2509
2510 /*
2511  * Make the source directory our root so symlinks cannot escape and no other
2512  * files are accessible.  Assumes unshare(CLONE_NEWNS) was already called.
2513  */
2514 static void setup_mounts(const char *source)
2515 {
2516     int oldroot;
2517     int newroot;
2518
2519     if (mount(source, source, NULL, MS_BIND | MS_REC, NULL) < 0) {
2520         fuse_log(FUSE_LOG_ERR, "mount(%s, %s, MS_BIND): %m\n", source, source);
2521         exit(1);
2522     }
2523
2524     /* This magic is based on lxc's lxc_pivot_root() */
2525     oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2526     if (oldroot < 0) {
2527         fuse_log(FUSE_LOG_ERR, "open(/): %m\n");
2528         exit(1);
2529     }
2530
2531     newroot = open(source, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2532     if (newroot < 0) {
2533         fuse_log(FUSE_LOG_ERR, "open(%s): %m\n", source);
2534         exit(1);
2535     }
2536
2537     if (fchdir(newroot) < 0) {
2538         fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2539         exit(1);
2540     }
2541
2542     if (syscall(__NR_pivot_root, ".", ".") < 0) {
2543         fuse_log(FUSE_LOG_ERR, "pivot_root(., .): %m\n");
2544         exit(1);
2545     }
2546
2547     if (fchdir(oldroot) < 0) {
2548         fuse_log(FUSE_LOG_ERR, "fchdir(oldroot): %m\n");
2549         exit(1);
2550     }
2551
2552     if (mount("", ".", "", MS_SLAVE | MS_REC, NULL) < 0) {
2553         fuse_log(FUSE_LOG_ERR, "mount(., MS_SLAVE | MS_REC): %m\n");
2554         exit(1);
2555     }
2556
2557     if (umount2(".", MNT_DETACH) < 0) {
2558         fuse_log(FUSE_LOG_ERR, "umount2(., MNT_DETACH): %m\n");
2559         exit(1);
2560     }
2561
2562     if (fchdir(newroot) < 0) {
2563         fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2564         exit(1);
2565     }
2566
2567     close(newroot);
2568     close(oldroot);
2569 }
2570
2571 /*
2572  * Only keep whitelisted capabilities that are needed for file system operation
2573  */
2574 static void setup_capabilities(void)
2575 {
2576     pthread_mutex_lock(&cap.mutex);
2577     capng_restore_state(&cap.saved);
2578
2579     /*
2580      * Whitelist file system-related capabilities that are needed for a file
2581      * server to act like root.  Drop everything else like networking and
2582      * sysadmin capabilities.
2583      *
2584      * Exclusions:
2585      * 1. CAP_LINUX_IMMUTABLE is not included because it's only used via ioctl
2586      *    and we don't support that.
2587      * 2. CAP_MAC_OVERRIDE is not included because it only seems to be
2588      *    used by the Smack LSM.  Omit it until there is demand for it.
2589      */
2590     capng_setpid(syscall(SYS_gettid));
2591     capng_clear(CAPNG_SELECT_BOTH);
2592     capng_updatev(CAPNG_ADD, CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2593             CAP_CHOWN,
2594             CAP_DAC_OVERRIDE,
2595             CAP_DAC_READ_SEARCH,
2596             CAP_FOWNER,
2597             CAP_FSETID,
2598             CAP_SETGID,
2599             CAP_SETUID,
2600             CAP_MKNOD,
2601             CAP_SETFCAP);
2602     capng_apply(CAPNG_SELECT_BOTH);
2603
2604     cap.saved = capng_save_state();
2605     pthread_mutex_unlock(&cap.mutex);
2606 }
2607
2608 /*
2609  * Lock down this process to prevent access to other processes or files outside
2610  * source directory.  This reduces the impact of arbitrary code execution bugs.
2611  */
2612 static void setup_sandbox(struct lo_data *lo, struct fuse_session *se,
2613                           bool enable_syslog)
2614 {
2615     setup_namespaces(lo, se);
2616     setup_mounts(lo->source);
2617     setup_seccomp(enable_syslog);
2618     setup_capabilities();
2619 }
2620
2621 /* Set the maximum number of open file descriptors */
2622 static void setup_nofile_rlimit(unsigned long rlimit_nofile)
2623 {
2624     struct rlimit rlim = {
2625         .rlim_cur = rlimit_nofile,
2626         .rlim_max = rlimit_nofile,
2627     };
2628
2629     if (rlimit_nofile == 0) {
2630         return; /* nothing to do */
2631     }
2632
2633     if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2634         /* Ignore SELinux denials */
2635         if (errno == EPERM) {
2636             return;
2637         }
2638
2639         fuse_log(FUSE_LOG_ERR, "setrlimit(RLIMIT_NOFILE): %m\n");
2640         exit(1);
2641     }
2642 }
2643
2644 static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
2645 {
2646     g_autofree char *localfmt = NULL;
2647
2648     if (current_log_level < level) {
2649         return;
2650     }
2651
2652     if (current_log_level == FUSE_LOG_DEBUG) {
2653         if (!use_syslog) {
2654             localfmt = g_strdup_printf("[%" PRId64 "] [ID: %08ld] %s",
2655                                        get_clock(), syscall(__NR_gettid), fmt);
2656         } else {
2657             localfmt = g_strdup_printf("[ID: %08ld] %s", syscall(__NR_gettid),
2658                                        fmt);
2659         }
2660         fmt = localfmt;
2661     }
2662
2663     if (use_syslog) {
2664         int priority = LOG_ERR;
2665         switch (level) {
2666         case FUSE_LOG_EMERG:
2667             priority = LOG_EMERG;
2668             break;
2669         case FUSE_LOG_ALERT:
2670             priority = LOG_ALERT;
2671             break;
2672         case FUSE_LOG_CRIT:
2673             priority = LOG_CRIT;
2674             break;
2675         case FUSE_LOG_ERR:
2676             priority = LOG_ERR;
2677             break;
2678         case FUSE_LOG_WARNING:
2679             priority = LOG_WARNING;
2680             break;
2681         case FUSE_LOG_NOTICE:
2682             priority = LOG_NOTICE;
2683             break;
2684         case FUSE_LOG_INFO:
2685             priority = LOG_INFO;
2686             break;
2687         case FUSE_LOG_DEBUG:
2688             priority = LOG_DEBUG;
2689             break;
2690         }
2691         vsyslog(priority, fmt, ap);
2692     } else {
2693         vfprintf(stderr, fmt, ap);
2694     }
2695 }
2696
2697 static void setup_root(struct lo_data *lo, struct lo_inode *root)
2698 {
2699     int fd, res;
2700     struct stat stat;
2701
2702     fd = open("/", O_PATH);
2703     if (fd == -1) {
2704         fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", lo->source);
2705         exit(1);
2706     }
2707
2708     res = fstatat(fd, "", &stat, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
2709     if (res == -1) {
2710         fuse_log(FUSE_LOG_ERR, "fstatat(%s): %m\n", lo->source);
2711         exit(1);
2712     }
2713
2714     root->filetype = S_IFDIR;
2715     root->fd = fd;
2716     root->key.ino = stat.st_ino;
2717     root->key.dev = stat.st_dev;
2718     root->nlookup = 2;
2719     g_atomic_int_set(&root->refcount, 2);
2720 }
2721
2722 static guint lo_key_hash(gconstpointer key)
2723 {
2724     const struct lo_key *lkey = key;
2725
2726     return (guint)lkey->ino + (guint)lkey->dev;
2727 }
2728
2729 static gboolean lo_key_equal(gconstpointer a, gconstpointer b)
2730 {
2731     const struct lo_key *la = a;
2732     const struct lo_key *lb = b;
2733
2734     return la->ino == lb->ino && la->dev == lb->dev;
2735 }
2736
2737 static void fuse_lo_data_cleanup(struct lo_data *lo)
2738 {
2739     if (lo->inodes) {
2740         g_hash_table_destroy(lo->inodes);
2741     }
2742     lo_map_destroy(&lo->fd_map);
2743     lo_map_destroy(&lo->dirp_map);
2744     lo_map_destroy(&lo->ino_map);
2745
2746     if (lo->proc_self_fd >= 0) {
2747         close(lo->proc_self_fd);
2748     }
2749
2750     if (lo->root.fd >= 0) {
2751         close(lo->root.fd);
2752     }
2753
2754     free(lo->source);
2755 }
2756
2757 int main(int argc, char *argv[])
2758 {
2759     struct fuse_args args = FUSE_ARGS_INIT(argc, argv);
2760     struct fuse_session *se;
2761     struct fuse_cmdline_opts opts;
2762     struct lo_data lo = {
2763         .debug = 0,
2764         .writeback = 0,
2765         .posix_lock = 1,
2766         .proc_self_fd = -1,
2767     };
2768     struct lo_map_elem *root_elem;
2769     int ret = -1;
2770
2771     /* Don't mask creation mode, kernel already did that */
2772     umask(0);
2773
2774     pthread_mutex_init(&lo.mutex, NULL);
2775     lo.inodes = g_hash_table_new(lo_key_hash, lo_key_equal);
2776     lo.root.fd = -1;
2777     lo.root.fuse_ino = FUSE_ROOT_ID;
2778     lo.cache = CACHE_AUTO;
2779
2780     /*
2781      * Set up the ino map like this:
2782      * [0] Reserved (will not be used)
2783      * [1] Root inode
2784      */
2785     lo_map_init(&lo.ino_map);
2786     lo_map_reserve(&lo.ino_map, 0)->in_use = false;
2787     root_elem = lo_map_reserve(&lo.ino_map, lo.root.fuse_ino);
2788     root_elem->inode = &lo.root;
2789
2790     lo_map_init(&lo.dirp_map);
2791     lo_map_init(&lo.fd_map);
2792
2793     if (fuse_parse_cmdline(&args, &opts) != 0) {
2794         goto err_out1;
2795     }
2796     fuse_set_log_func(log_func);
2797     use_syslog = opts.syslog;
2798     if (use_syslog) {
2799         openlog("virtiofsd", LOG_PID, LOG_DAEMON);
2800     }
2801
2802     if (opts.show_help) {
2803         printf("usage: %s [options]\n\n", argv[0]);
2804         fuse_cmdline_help();
2805         printf("    -o source=PATH             shared directory tree\n");
2806         fuse_lowlevel_help();
2807         ret = 0;
2808         goto err_out1;
2809     } else if (opts.show_version) {
2810         fuse_lowlevel_version();
2811         ret = 0;
2812         goto err_out1;
2813     } else if (opts.print_capabilities) {
2814         print_capabilities();
2815         ret = 0;
2816         goto err_out1;
2817     }
2818
2819     if (fuse_opt_parse(&args, &lo, lo_opts, NULL) == -1) {
2820         goto err_out1;
2821     }
2822
2823     /*
2824      * log_level is 0 if not configured via cmd options (0 is LOG_EMERG,
2825      * and we don't use this log level).
2826      */
2827     if (opts.log_level != 0) {
2828         current_log_level = opts.log_level;
2829     }
2830     lo.debug = opts.debug;
2831     if (lo.debug) {
2832         current_log_level = FUSE_LOG_DEBUG;
2833     }
2834     if (lo.source) {
2835         struct stat stat;
2836         int res;
2837
2838         res = lstat(lo.source, &stat);
2839         if (res == -1) {
2840             fuse_log(FUSE_LOG_ERR, "failed to stat source (\"%s\"): %m\n",
2841                      lo.source);
2842             exit(1);
2843         }
2844         if (!S_ISDIR(stat.st_mode)) {
2845             fuse_log(FUSE_LOG_ERR, "source is not a directory\n");
2846             exit(1);
2847         }
2848     } else {
2849         lo.source = strdup("/");
2850     }
2851     if (!lo.timeout_set) {
2852         switch (lo.cache) {
2853         case CACHE_NONE:
2854             lo.timeout = 0.0;
2855             break;
2856
2857         case CACHE_AUTO:
2858             lo.timeout = 1.0;
2859             break;
2860
2861         case CACHE_ALWAYS:
2862             lo.timeout = 86400.0;
2863             break;
2864         }
2865     } else if (lo.timeout < 0) {
2866         fuse_log(FUSE_LOG_ERR, "timeout is negative (%lf)\n", lo.timeout);
2867         exit(1);
2868     }
2869
2870     se = fuse_session_new(&args, &lo_oper, sizeof(lo_oper), &lo);
2871     if (se == NULL) {
2872         goto err_out1;
2873     }
2874
2875     if (fuse_set_signal_handlers(se) != 0) {
2876         goto err_out2;
2877     }
2878
2879     if (fuse_session_mount(se) != 0) {
2880         goto err_out3;
2881     }
2882
2883     fuse_daemonize(opts.foreground);
2884
2885     setup_nofile_rlimit(opts.rlimit_nofile);
2886
2887     /* Must be before sandbox since it wants /proc */
2888     setup_capng();
2889
2890     setup_sandbox(&lo, se, opts.syslog);
2891
2892     setup_root(&lo, &lo.root);
2893     /* Block until ctrl+c or fusermount -u */
2894     ret = virtio_loop(se);
2895
2896     fuse_session_unmount(se);
2897     cleanup_capng();
2898 err_out3:
2899     fuse_remove_signal_handlers(se);
2900 err_out2:
2901     fuse_session_destroy(se);
2902 err_out1:
2903     fuse_opt_free_args(&args);
2904
2905     fuse_lo_data_cleanup(&lo);
2906
2907     return ret ? 1 : 0;
2908 }