fuse: fix illegal access to inode with reused nodeid

Server responds to LOOKUP and other ops (READDIRPLUS/CREATE/MKNOD/...)
with ourarg containing nodeid and generation.

If a fuse inode is found in inode cache with the same nodeid but different
generation, the existing fuse inode should be unhashed and marked "bad" and
a new inode with the new generation should be hashed instead.

This can happen, for example, with passhrough fuse filesystem that returns
the real filesystem ino/generation on lookup and where real inode numbers
can get recycled due to real files being unlinked not via the fuse
passthrough filesystem.

With current code, this situation will not be detected and an old fuse
dentry that used to point to an older generation real inode, can be used to
access a completely new inode, which should be accessed only via the new
dentry.

Note that because the FORGET message carries the nodeid w/o generation, the
server should wait to get FORGET counts for the nlookup counts of the old
and reused inodes combined, before it can free the resources associated to
that nodeid.

Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 361150b7e807bdd615a47f43c67b8b7e7bee3f9d..eade6f965b2ee32988ecb5dcd34d037566375ada 100644 (file)
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -252,7 +252,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
                if (ret == -ENOMEM)
                        goto out;
                if (ret || fuse_invalid_attr(&outarg.attr) ||
-                   inode_wrong_type(inode, outarg.attr.mode))
+                   fuse_stale_inode(inode, outarg.generation, &outarg.attr))
                        goto invalid;
 
                forget_all_cached_acls(inode);

diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index de6489f0a145c5a7b1962aa305c573bf706d34e6..07829ce78695b9a14c06c73d9491ff820be5dba2 100644 (file)
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -870,6 +870,13 @@ static inline u64 fuse_get_attr_version(struct fuse_conn *fc)
        return atomic64_read(&fc->attr_version);
 }
 
+static inline bool fuse_stale_inode(const struct inode *inode, int generation,
+                                   struct fuse_attr *attr)
+{
+       return inode->i_generation != generation ||
+               inode_wrong_type(inode, attr->mode);
+}
+
 static inline void fuse_make_bad(struct inode *inode)
 {
        remove_inode_hash(inode);

diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 04f25f49c37f3c5af7651c48cf8e050a08227527..b9beb39a4a1811a14d55ebd1597580f6d8d0e313 100644 (file)
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -350,8 +350,8 @@ retry:
                inode->i_generation = generation;
                fuse_init_inode(inode, attr);
                unlock_new_inode(inode);
-       } else if (inode_wrong_type(inode, attr->mode)) {
-               /* Inode has changed type, any I/O on the old should fail */
+       } else if (fuse_stale_inode(inode, generation, attr)) {
+               /* nodeid was reused, any I/O on the old inode should fail */
                fuse_make_bad(inode);
                iput(inode);
                goto retry;

diff --git a/fs/fuse/readdir.c b/fs/fuse/readdir.c
index 277f7041d55aacd1285e674f4f46f746cdf08ad1..bc267832310c7c8c26703b3a13ec0c535f1a5d44 100644 (file)
--- a/fs/fuse/readdir.c
+++ b/fs/fuse/readdir.c
@@ -200,9 +200,12 @@ retry:
        if (!d_in_lookup(dentry)) {
                struct fuse_inode *fi;
                inode = d_inode(dentry);
+               if (inode && get_node_id(inode) != o->nodeid)
+                       inode = NULL;
                if (!inode ||
-                   get_node_id(inode) != o->nodeid ||
-                   inode_wrong_type(inode, o->attr.mode)) {
+                   fuse_stale_inode(inode, o->generation, &o->attr)) {
+                       if (inode)
+                               fuse_make_bad(inode);
                        d_invalidate(dentry);
                        dput(dentry);
                        goto retry;