[PATCH 03/25] virtiofsd: passthrough_ll: add ino_map to hide lo_inode pointers

["Dr. David Alan Gilbert (git)" <dgilbert@redhat.com>]

From: Stefan Hajnoczi <stefanha@redhat.com>

Do not expose lo_inode pointers to clients.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 contrib/virtiofsd/passthrough_ll.c | 125 ++++++++++++++++++++++++-----
 1 file changed, 105 insertions(+), 20 deletions(-)

diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c
index 3093d1171e..f718c951f7 100644
--- a/contrib/virtiofsd/passthrough_ll.c
+++ b/contrib/virtiofsd/passthrough_ll.c
@@ -56,8 +56,8 @@
 
 #define HAVE_POSIX_FALLOCATE 1
 
-/* We are re-using pointers to our `struct lo_inode` and `struct
-   lo_dirp` elements as inodes. This means that we must be able to
+/* We are re-using pointers to our `struct lo_dirp`
+   elements as inodes. This means that we must be able to
    store uintptr_t values in a fuse_ino_t variable. The following
    incantation checks this condition at compile time. */
 #if defined(__GNUC__) && (__GNUC__ > 4 || __GNUC__ == 4 && __GNUC_MINOR__ >= 6) && !defined __cplusplus
@@ -71,7 +71,7 @@ struct _uintptr_to_must_hold_fuse_ino_t_dummy_struct \
 
 struct lo_map_elem {
 	union {
-		/* Element values will go here... */
+		struct lo_inode *inode;
 		ssize_t freelist;
 	};
 	bool in_use;
@@ -92,6 +92,7 @@ struct lo_inode {
 	ino_t ino;
 	dev_t dev;
 	uint64_t refcount; /* protected by lo->mutex */
+	fuse_ino_t fuse_ino;
 };
 
 struct lo_cred {
@@ -116,6 +117,7 @@ struct lo_data {
 	int cache;
 	int timeout_set;
 	struct lo_inode root; /* protected by lo->mutex */
+	struct lo_map ino_map; /* protected by lo->mutex */
 };
 
 static const struct fuse_opt lo_opts[] = {
@@ -250,17 +252,38 @@ static void lo_map_remove(struct lo_map *map, size_t key)
 	map->freelist = key;
 }
 
+/* Assumes lo->mutex is held */
+static ssize_t lo_add_inode_mapping(fuse_req_t req, struct lo_inode *inode)
+{
+	struct lo_map_elem *elem;
+
+	elem = lo_map_alloc_elem(&lo_data(req)->ino_map);
+	if (!elem)
+		return -1;
+
+	elem->inode = inode;
+	return elem - lo_data(req)->ino_map.elems;
+}
+
 static struct lo_inode *lo_inode(fuse_req_t req, fuse_ino_t ino)
 {
-	if (ino == FUSE_ROOT_ID)
-		return &lo_data(req)->root;
-	else
-		return (struct lo_inode *) (uintptr_t) ino;
+	struct lo_data *lo = lo_data(req);
+	struct lo_map_elem *elem;
+
+	pthread_mutex_lock(&lo->mutex);
+	elem = lo_map_get(&lo->ino_map, ino);
+	pthread_mutex_unlock(&lo->mutex);
+
+	if (!elem)
+		return NULL;
+
+	return elem->inode;
 }
 
 static int lo_fd(fuse_req_t req, fuse_ino_t ino)
 {
-	return lo_inode(req, ino)->fd;
+	struct lo_inode *inode = lo_inode(req, ino);
+	return inode ? inode->fd : -1;
 }
 
 static bool lo_debug(fuse_req_t req)
@@ -330,10 +353,18 @@ static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,
 {
 	int saverr;
 	char procname[64];
-	struct lo_inode *inode = lo_inode(req, ino);
-	int ifd = inode->fd;
+	struct lo_inode *inode;
+	int ifd;
 	int res;
 
+	inode = lo_inode(req, ino);
+	if (!inode) {
+		fuse_reply_err(req, EBADF);
+		return;
+	}
+
+	ifd = inode->fd;
+
 	if (valid & FUSE_SET_ATTR_MODE) {
 		if (fi) {
 			res = fchmod(fi->fh, attr->st_mode);
@@ -456,6 +487,7 @@ static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
 		inode->dev = e->attr.st_dev;
 
 		pthread_mutex_lock(&lo->mutex);
+		inode->fuse_ino = lo_add_inode_mapping(req, inode);
 		prev = &lo->root;
 		next = prev->next;
 		next->prev = inode;
@@ -464,7 +496,7 @@ static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
 		prev->next = inode;
 		pthread_mutex_unlock(&lo->mutex);
 	}
-	e->ino = (uintptr_t) inode;
+	e->ino = inode->fuse_ino;
 
 	if (lo_debug(req))
 		fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n",
@@ -546,10 +578,16 @@ static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t parent,
 {
 	int res;
 	int saverr;
-	struct lo_inode *dir = lo_inode(req, parent);
+	struct lo_inode *dir;
 	struct fuse_entry_param e;
 	struct lo_cred old = {};
 
+	dir = lo_inode(req, parent);
+	if (!dir) {
+		fuse_reply_err(req, EBADF);
+		return;
+	}
+
 	saverr = ENOMEM;
 
 	saverr = lo_change_cred(req, &old);
@@ -623,10 +661,16 @@ static void lo_link(fuse_req_t req, fuse_ino_t ino, fuse_ino_t parent,
 {
 	int res;
 	struct lo_data *lo = lo_data(req);
-	struct lo_inode *inode = lo_inode(req, ino);
+	struct lo_inode *inode;
 	struct fuse_entry_param e;
 	int saverr;
 
+	inode = lo_inode(req, ino);
+	if (!inode) {
+		fuse_reply_err(req, EBADF);
+		return;
+	}
+
 	memset(&e, 0, sizeof(struct fuse_entry_param));
 	e.attr_timeout = lo->timeout;
 	e.entry_timeout = lo->timeout;
@@ -642,7 +686,7 @@ static void lo_link(fuse_req_t req, fuse_ino_t ino, fuse_ino_t parent,
 	pthread_mutex_lock(&lo->mutex);
 	inode->refcount++;
 	pthread_mutex_unlock(&lo->mutex);
-	e.ino = (uintptr_t) inode;
+	e.ino = inode->fuse_ino;
 
 	if (lo_debug(req))
 		fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n",
@@ -708,10 +752,10 @@ static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t n)
 		next->prev = prev;
 		prev->next = next;
 
+		lo_map_remove(&lo->ino_map, inode->fuse_ino);
 		pthread_mutex_unlock(&lo->mutex);
 		close(inode->fd);
 		free(inode);
-
 	} else {
 		pthread_mutex_unlock(&lo->mutex);
 	}
@@ -720,7 +764,11 @@ static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t n)
 static void lo_forget_one(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
 {
 	struct lo_data *lo = lo_data(req);
-	struct lo_inode *inode = lo_inode(req, ino);
+	struct lo_inode *inode;
+
+	inode = lo_inode(req, ino);
+	if (!inode)
+		return;
 
 	if (lo_debug(req)) {
 		fuse_log(FUSE_LOG_DEBUG, "  forget %lli %lli -%lli\n",
@@ -1161,10 +1209,16 @@ static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
 {
 	char *value = NULL;
 	char procname[64];
-	struct lo_inode *inode = lo_inode(req, ino);
+	struct lo_inode *inode;
 	ssize_t ret;
 	int saverr;
 
+	inode = lo_inode(req, ino);
+	if (!inode) {
+		fuse_reply_err(req, EBADF);
+		return;
+	}
+
 	saverr = ENOSYS;
 	if (!lo_data(req)->xattr)
 		goto out;
@@ -1217,10 +1271,16 @@ static void lo_listxattr(fuse_req_t req, fuse_ino_t ino, size_t size)
 {
 	char *value = NULL;
 	char procname[64];
-	struct lo_inode *inode = lo_inode(req, ino);
+	struct lo_inode *inode;
 	ssize_t ret;
 	int saverr;
 
+	inode = lo_inode(req, ino);
+	if (!inode) {
+		fuse_reply_err(req, EBADF);
+		return;
+	}
+
 	saverr = ENOSYS;
 	if (!lo_data(req)->xattr)
 		goto out;
@@ -1273,10 +1333,16 @@ static void lo_setxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
 			const char *value, size_t size, int flags)
 {
 	char procname[64];
-	struct lo_inode *inode = lo_inode(req, ino);
+	struct lo_inode *inode;
 	ssize_t ret;
 	int saverr;
 
+	inode = lo_inode(req, ino);
+	if (!inode) {
+		fuse_reply_err(req, EBADF);
+		return;
+	}
+
 	saverr = ENOSYS;
 	if (!lo_data(req)->xattr)
 		goto out;
@@ -1304,10 +1370,16 @@ out:
 static void lo_removexattr(fuse_req_t req, fuse_ino_t ino, const char *name)
 {
 	char procname[64];
-	struct lo_inode *inode = lo_inode(req, ino);
+	struct lo_inode *inode;
 	ssize_t ret;
 	int saverr;
 
+	inode = lo_inode(req, ino);
+	if (!inode) {
+		fuse_reply_err(req, EBADF);
+		return;
+	}
+
 	saverr = ENOSYS;
 	if (!lo_data(req)->xattr)
 		goto out;
@@ -1411,6 +1483,7 @@ int main(int argc, char *argv[])
 	struct fuse_cmdline_opts opts;
 	struct lo_data lo = { .debug = 0,
 	                      .writeback = 0 };
+	struct lo_map_elem *root_elem;
 	int ret = -1;
 
 	/* Don't mask creation mode, kernel already did that */
@@ -1419,8 +1492,18 @@ int main(int argc, char *argv[])
 	pthread_mutex_init(&lo.mutex, NULL);
 	lo.root.next = lo.root.prev = &lo.root;
 	lo.root.fd = -1;
+	lo.root.fuse_ino = FUSE_ROOT_ID;
 	lo.cache = CACHE_NORMAL;
 
+	/* Set up the ino map like this:
+	 * [0] Reserved (will not be used)
+	 * [1] Root inode
+	 */
+	lo_map_init(&lo.ino_map);
+	lo_map_reserve(&lo.ino_map, 0)->in_use = false;
+	root_elem = lo_map_reserve(&lo.ino_map, lo.root.fuse_ino);
+	root_elem->inode = &lo.root;
+
 	if (fuse_parse_cmdline(&args, &opts) != 0)
 		return 1;
 	if (opts.show_help) {
@@ -1514,6 +1597,8 @@ err_out2:
 err_out1:
 	fuse_opt_free_args(&args);
 
+	lo_map_destroy(&lo.ino_map);
+
 	if (lo.root.fd >= 0)
 		close(lo.root.fd);
 
-- 
2.23.0