From: Xiubo Li <xiubli@redhat.com>
Date: Wed, 7 Apr 2021 11:37:26 +0000 (+0800)
Subject: client: don't allow access to MDS-private inodes
X-Git-Tag: v16.2.5~33^2~3
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=427e57fb5d766ade63f4d305325a833bef5c3003;p=ceph.git

client: don't allow access to MDS-private inodes

Fixes: https://tracker.ceph.com/issues/50112
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 89c511356125f892477ef42bd14c0b447ff06106)
---

diff --git a/src/client/Client.cc b/src/client/Client.cc
index f541c263778..ffd38b5bf8e 100644
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -160,6 +160,14 @@ void client_flush_set_callback(void *p, ObjectCacher::ObjectSet *oset)
   client->flush_set_callback(oset);
 }
 
+bool Client::is_reserved_vino(vinodeno_t &vino) {
+  if (vino.ino < MDS_INO_SYSTEM_BASE && vino.ino != MDS_INO_ROOT) {
+    ldout(cct, -1) << __func__ << "attempt to access reserved inode number " << vino << dendl;
+    return true;
+  }
+  return false;
+}
+
 
 // -------------
 
@@ -9296,6 +9304,9 @@ int Client::_lookup_vino(vinodeno_t vino, const UserPerm& perms, Inode **inode)
   if (!mref_reader.is_state_satisfied())
     return -CEPHFS_ENOTCONN;
 
+  if (is_reserved_vino(vino))
+    return -CEPHFS_ESTALE;
+
   MetaRequest *req = new MetaRequest(CEPH_MDS_OP_LOOKUPINO);
   filepath path(vino.ino);
   req->set_filepath(path);
@@ -11593,6 +11604,9 @@ int Client::ll_lookup_vino(
   if (!mref_reader.is_state_satisfied())
     return -CEPHFS_ENOTCONN;
 
+  if (is_reserved_vino(vino))
+    return -CEPHFS_ESTALE;
+
   std::scoped_lock lock(client_lock);
   ldout(cct, 3) << __func__ << " " << vino << dendl;
 
@@ -11847,6 +11861,9 @@ Inode *Client::ll_get_inode(vinodeno_t vino)
   if (!mref_reader.is_state_satisfied())
     return NULL;
 
+  if (is_reserved_vino(vino))
+    return NULL;
+
   std::scoped_lock lock(client_lock);
 
   unordered_map<vinodeno_t,Inode*>::iterator p = inode_map.find(vino);
diff --git a/src/client/Client.h b/src/client/Client.h
index d3c3a90b85b..644fcf090dc 100644
--- a/src/client/Client.h
+++ b/src/client/Client.h
@@ -1255,6 +1255,7 @@ private:
   static const VXattr _common_vxattrs[];
 
 
+  bool is_reserved_vino(vinodeno_t &vino);
 
   void fill_dirent(struct dirent *de, const char *name, int type, uint64_t ino, loff_t next_off);