From f78a4d1e017189db53083ac8c28568b5a9f58996 Mon Sep 17 00:00:00 2001 From: Patrick Donnelly Date: Wed, 24 Mar 2021 13:54:17 -0700 Subject: [PATCH] mds: reject lookup ino requests for mds dirs Fixes: https://tracker.ceph.com/issues/49922 Signed-off-by: Patrick Donnelly (cherry picked from commit 682a55e8a22a137f80855f2cdd98f6f230d67fce) Conflicts: src/mds/Server.cc - octopus wants ESTALE instead of CEPHFS_ESTALE - octopus wants CEPH_INO_ROOT instead of MDS_INO_ROOT --- src/mds/Server.cc | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/mds/Server.cc b/src/mds/Server.cc index e4b9c28e3fe1e..0583e3c28f836 100644 --- a/src/mds/Server.cc +++ b/src/mds/Server.cc @@ -3863,6 +3863,19 @@ void Server::handle_client_lookup_ino(MDRequestRef& mdr, return _lookup_snap_ino(mdr); inodeno_t ino = req->get_filepath().get_ino(); + auto _ino = ino.val; + + /* It's been observed [1] that a client may lookup a private ~mdsdir inode. + * I do not have an explanation for how that happened organically but this + * check will ensure that the client can no longer do that. + * + * [1] https://tracker.ceph.com/issues/49922 + */ + if (_ino < MDS_INO_SYSTEM_BASE && _ino != CEPH_INO_ROOT) { + respond_to_request(mdr, -ESTALE); + return; + } + CInode *in = mdcache->get_inode(ino); if (in && in->state_test(CInode::STATE_PURGING)) { respond_to_request(mdr, -ESTALE); -- 2.39.5