virtiofsd: introduce inode refcount to prevent use-after-free
commitc241aa9457d88c6a0d027f48fadfed131646bce3
authorStefan Hajnoczi <stefanha@redhat.com>
Wed, 31 Jul 2019 16:10:06 +0000 (31 17:10 +0100)
committerDr. David Alan Gilbert <dgilbert@redhat.com>
Thu, 23 Jan 2020 16:41:37 +0000 (23 16:41 +0000)
tree156c5132b4be8c64852c8a1904c2ca001756f78c
parent9257e514d861afa759c36704e1904d43ca3fec88
virtiofsd: introduce inode refcount to prevent use-after-free

If thread A is using an inode it must not be deleted by thread B when
processing a FUSE_FORGET request.

The FUSE protocol itself already has a counter called nlookup that is
used in FUSE_FORGET messages.  We cannot trust this counter since the
untrusted client can manipulate it via FUSE_FORGET messages.

Introduce a new refcount to keep inodes alive for the required lifespan.
lo_inode_put() must be called to release a reference.  FUSE's nlookup
counter holds exactly one reference so that the inode stays alive as
long as the client still wants to remember it.

Note that the lo_inode->is_symlink field is moved to avoid creating a
hole in the struct due to struct field alignment.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Reviewed-by: Sergio Lopez <slp@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
tools/virtiofsd/passthrough_ll.c