client: don't allow access to MDS-private inodes

Fixes: https://tracker.ceph.com/issues/50112
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 89c511356125f892477ef42bd14c0b447ff06106)

diff --git a/src/client/Client.cc b/src/client/Client.cc
index f541c2637789786569c5db859d6e34d563eee250..ffd38b5bf8eeb9e6390b772f59949fec42740244 100644 (file)
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -160,6 +160,14 @@ void client_flush_set_callback(void *p, ObjectCacher::ObjectSet *oset)
   client->flush_set_callback(oset);
 }
 
+bool Client::is_reserved_vino(vinodeno_t &vino) {
+  if (vino.ino < MDS_INO_SYSTEM_BASE && vino.ino != MDS_INO_ROOT) {
+    ldout(cct, -1) << __func__ << "attempt to access reserved inode number " << vino << dendl;
+    return true;
+  }
+  return false;
+}
+
 
 // -------------
 
@@ -9296,6 +9304,9 @@ int Client::_lookup_vino(vinodeno_t vino, const UserPerm& perms, Inode **inode)
   if (!mref_reader.is_state_satisfied())
     return -CEPHFS_ENOTCONN;
 
+  if (is_reserved_vino(vino))
+    return -CEPHFS_ESTALE;
+
   MetaRequest *req = new MetaRequest(CEPH_MDS_OP_LOOKUPINO);
   filepath path(vino.ino);
   req->set_filepath(path);
@@ -11593,6 +11604,9 @@ int Client::ll_lookup_vino(
   if (!mref_reader.is_state_satisfied())
     return -CEPHFS_ENOTCONN;
 
+  if (is_reserved_vino(vino))
+    return -CEPHFS_ESTALE;
+
   std::scoped_lock lock(client_lock);
   ldout(cct, 3) << __func__ << " " << vino << dendl;
 
@@ -11847,6 +11861,9 @@ Inode *Client::ll_get_inode(vinodeno_t vino)
   if (!mref_reader.is_state_satisfied())
     return NULL;
 
+  if (is_reserved_vino(vino))
+    return NULL;
+
   std::scoped_lock lock(client_lock);
 
   unordered_map<vinodeno_t,Inode*>::iterator p = inode_map.find(vino);

diff --git a/src/client/Client.h b/src/client/Client.h
index d3c3a90b85b9e98377751e503f637250a7790f17..644fcf090dcc5eee13124894a62351f3e063e980 100644 (file)
--- a/src/client/Client.h
+++ b/src/client/Client.h
@@ -1255,6 +1255,7 @@ private:
   static const VXattr _common_vxattrs[];
 
 
+  bool is_reserved_vino(vinodeno_t &vino);
 
   void fill_dirent(struct dirent *de, const char *name, int type, uint64_t ino, loff_t next_off);