From: Greg Kurz <groug@kaod.org>
To: JeffleXu <jefflexu@linux.alibaba.com>
Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com>,
<miklos@szeredi.hu>, <virtualization@lists.linux-foundation.org>,
<virtio-fs@redhat.com>, <joseph.qi@linux.alibaba.com>,
<stefanha@redhat.com>, <linux-fsdevel@vger.kernel.org>,
<vgoyal@redhat.com>
Subject: Re: [Virtio-fs] [virtiofsd PATCH v4 4/4] virtiofsd: support per-file DAX in FUSE_LOOKUP
Date: Tue, 24 Aug 2021 12:15:15 +0200 [thread overview]
Message-ID: <20210824121515.5419d6a7@bahia.lan> (raw)
In-Reply-To: <4494052b-aff1-e2e3-e704-c8743168f62e@linux.alibaba.com>
On Fri, 20 Aug 2021 13:03:23 +0800
JeffleXu <jefflexu@linux.alibaba.com> wrote:
>
>
> On 8/19/21 9:08 PM, Dr. David Alan Gilbert wrote:
> > * JeffleXu (jefflexu@linux.alibaba.com) wrote:
> >>
> >>
> >> On 8/18/21 3:00 AM, Dr. David Alan Gilbert wrote:
> >>> * Jeffle Xu (jefflexu@linux.alibaba.com) wrote:
> >>>> For passthrough, when the corresponding virtiofs in guest is mounted
> >>>> with '-o dax=inode', advertise that the file is capable of per-file
> >>>> DAX if the inode in the backend fs is marked with FS_DAX_FL flag.
> >>>>
> >>>> Signed-off-by: Jeffle Xu <jefflexu@linux.alibaba.com>
> >>>> ---
> >>>> tools/virtiofsd/passthrough_ll.c | 43 ++++++++++++++++++++++++++++++++
> >>>> 1 file changed, 43 insertions(+)
> >>>>
> >>>> diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
> >>>> index 5b6228210f..4cbd904248 100644
> >>>> --- a/tools/virtiofsd/passthrough_ll.c
> >>>> +++ b/tools/virtiofsd/passthrough_ll.c
> >>>> @@ -171,6 +171,7 @@ struct lo_data {
> >>>> int allow_direct_io;
> >>>> int announce_submounts;
> >>>> int perfile_dax_cap; /* capability of backend fs */
> >>>> + bool perfile_dax; /* enable per-file DAX or not */
> >>>> bool use_statx;
> >>>> struct lo_inode root;
> >>>> GHashTable *inodes; /* protected by lo->mutex */
> >>>> @@ -716,6 +717,10 @@ static void lo_init(void *userdata, struct fuse_conn_info *conn)
> >>>>
> >>>> if (conn->capable & FUSE_CAP_PERFILE_DAX && lo->perfile_dax_cap ) {
> >>>> conn->want |= FUSE_CAP_PERFILE_DAX;
> >>>> + lo->perfile_dax = 1;
> >>>> + }
> >>>> + else {
> >>>> + lo->perfile_dax = 0;
> >>>> }
> >>>> }
> >>>>
> >>>> @@ -983,6 +988,41 @@ static int do_statx(struct lo_data *lo, int dirfd, const char *pathname,
> >>>> return 0;
> >>>> }
> >>>>
> >>>> +/*
> >>>> + * If the file is marked with FS_DAX_FL or FS_XFLAG_DAX, then DAX should be
> >>>> + * enabled for this file.
> >>>> + */
> >>>> +static bool lo_should_enable_dax(struct lo_data *lo, struct lo_inode *dir,
> >>>> + const char *name)
> >>>> +{
> >>>> + int res, fd;
> >>>> + int ret = false;;
> >>>> + unsigned int attr;
> >>>> + struct fsxattr xattr;
> >>>> +
> >>>> + if (!lo->perfile_dax)
> >>>> + return false;
> >>>> +
> >>>> + /* Open file without O_PATH, so that ioctl can be called. */
> >>>> + fd = openat(dir->fd, name, O_NOFOLLOW);
> >>>> + if (fd == -1)
> >>>> + return false;
> >>>
> >>> Doesn't that defeat the whole benefit of using O_PATH - i.e. that we
> >>> might stumble into a /dev node or something else we're not allowed to
> >>> open?
> >>
> >> As far as I know, virtiofsd will pivot_root/chroot to the source
> >> directory, and can only access files inside the source directory
> >> specified by "-o source=". Then where do these unexpected files come
> >> from? Besides, fd opened without O_PATH here is temporary and used for
> >> FS_IOC_GETFLAGS/FS_IOC_FSGETXATTR ioctl only. It's closed when the
> >> function returns.
> >
> > The guest is still allowed to mknod.
> > See:
> > https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg05461.html
> >
> > also it's legal to expose a root filesystem for a guest; the virtiofsd
> > should *never* open a device other than O_PATH - and it's really tricky
> > to do a check to see if it is a device in a race-free way.
> >
>
> Fine. Got it. However the returned fd (opened without O_PATH) is only
> used for FS_IOC_GETFLAGS/FS_IOC_FSGETXATTR ioctl, while in most cases
> for special device files, these two ioctls should return -ENOTTY.
>
The actual problem is that a FIFO will cause openat() to block until
the other end of the FIFO is open for writing...
> If it's really a security issue, then lo_inode_open() could be used to
... and cause a DoS on virtiofsd. So yes, this is a security issue and
lo_inode_open() was introduced specifically to handle this.
> get a temporary fd, i.e., check if it's a special file before opening.
> After all, FUSE_OPEN also handles in this way. Besides, I can't
> understand what "race-free way" means.
>
"race-free way" means a way that guarantees that file type
cannot change between the time you check it and the time
you open it (TOCTOU error). For example, doing a plain stat(),
checking st_mode and proceeding to open() is wrong : nothing
prevents the file to be unlinked and replaced by something
else between stat() and open().
We avoid that by keeping O_PATH fds around and using
lo_inode_open() instead of openat().
In your case, it seems that you should do the checking after
you have an actual lo_inode for the target file, and pass
that to lo_should_enable_dax() instead of the parent lo_inode
and target name.
Cheers,
--
Greg
next prev parent reply other threads:[~2021-08-24 10:15 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-17 2:22 [PATCH v4 0/8] fuse,virtiofs: support per-file DAX Jeffle Xu
2021-08-17 2:22 ` [PATCH v4 1/8] fuse: add fuse_should_enable_dax() helper Jeffle Xu
2021-08-17 2:22 ` [PATCH v4 2/8] fuse: Make DAX mount option a tri-state Jeffle Xu
2021-08-17 2:22 ` [PATCH v4 3/8] fuse: support per-file DAX Jeffle Xu
2021-08-17 2:22 ` [PATCH v4 4/8] fuse: negotiate if server/client supports " Jeffle Xu
2021-08-17 2:22 ` [PATCH v4 5/8] fuse: enable " Jeffle Xu
2021-08-17 2:22 ` [PATCH v4 6/8] fuse: mark inode DONT_CACHE when per-file DAX indication changes Jeffle Xu
2021-08-17 10:26 ` [Virtio-fs] " Dr. David Alan Gilbert
2021-08-17 13:23 ` JeffleXu
2021-08-17 2:22 ` [PATCH v4 7/8] fuse: support changing per-file DAX flag inside guest Jeffle Xu
2021-08-17 2:22 ` [PATCH v4 8/8] fuse: show '-o dax=inode' option only when FUSE server supports Jeffle Xu
2021-08-17 2:23 ` [virtiofsd PATCH v4 0/4] virtiofsd: support per-file DAX Jeffle Xu
2021-08-17 2:23 ` [virtiofsd PATCH v4 1/4] virtiofsd: add .ioctl() support Jeffle Xu
2021-08-18 17:33 ` Vivek Goyal
2021-08-17 2:23 ` [virtiofsd PATCH v4 2/4] virtiofsd: expand fuse protocol to support per-file DAX Jeffle Xu
2021-08-17 2:23 ` [virtiofsd PATCH v4 3/4] virtiofsd: support per-file DAX negotiation in FUSE_INIT Jeffle Xu
2021-08-17 17:15 ` [Virtio-fs] " Dr. David Alan Gilbert
2021-08-18 5:28 ` JeffleXu
2021-08-19 13:57 ` Dr. David Alan Gilbert
2021-08-18 17:30 ` Vivek Goyal
2021-08-17 2:23 ` [virtiofsd PATCH v4 4/4] virtiofsd: support per-file DAX in FUSE_LOOKUP Jeffle Xu
2021-08-17 19:00 ` [Virtio-fs] " Dr. David Alan Gilbert
2021-08-18 5:46 ` JeffleXu
2021-08-19 13:08 ` Dr. David Alan Gilbert
2021-08-20 5:03 ` JeffleXu
2021-08-24 10:15 ` Greg Kurz [this message]
2021-09-08 10:34 ` JeffleXu
2021-08-17 8:06 ` [PATCH v4 0/8] fuse,virtiofs: support per-file DAX Miklos Szeredi
2021-08-17 9:32 ` [Virtio-fs] " Dr. David Alan Gilbert
2021-08-17 10:09 ` Miklos Szeredi
2021-08-17 10:37 ` Dr. David Alan Gilbert
2021-08-17 13:08 ` JeffleXu
2021-08-17 14:11 ` Miklos Szeredi
2021-08-17 15:19 ` Vivek Goyal
2021-08-17 14:54 ` Vivek Goyal
2021-08-18 5:10 ` JeffleXu
2021-08-19 6:14 ` JeffleXu
2021-08-17 12:40 ` Vivek Goyal
2021-09-16 8:21 ` JeffleXu
2021-09-18 3:06 ` JeffleXu
2021-09-19 19:45 ` Vivek Goyal
2021-09-22 8:16 ` JeffleXu
2021-08-17 12:39 ` Vivek Goyal
2021-08-17 13:22 ` JeffleXu
2021-08-17 14:08 ` Miklos Szeredi
2021-08-18 3:39 ` JeffleXu
2021-08-18 5:08 ` Miklos Szeredi
2021-08-18 16:58 ` Vivek Goyal
2021-09-03 5:30 ` JeffleXu
2021-09-07 14:51 ` Miklos Szeredi
2021-08-17 14:57 ` Vivek Goyal
2021-08-18 5:20 ` JeffleXu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210824121515.5419d6a7@bahia.lan \
--to=groug@kaod.org \
--cc=dgilbert@redhat.com \
--cc=jefflexu@linux.alibaba.com \
--cc=joseph.qi@linux.alibaba.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=stefanha@redhat.com \
--cc=vgoyal@redhat.com \
--cc=virtio-fs@redhat.com \
--cc=virtualization@lists.linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).