From patchwork Thu Dec 12 16:38:03 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Dr. David Alan Gilbert" X-Patchwork-Id: 11288709 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E9CF7109A for ; Thu, 12 Dec 2019 17:12:32 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id AFFEB205C9 for ; Thu, 12 Dec 2019 17:12:32 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="WI25YA53" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AFFEB205C9 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Received: from localhost ([::1]:34484 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ifS0t-0000AT-Qx for patchwork-qemu-devel@patchwork.kernel.org; Thu, 12 Dec 2019 12:12:31 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:51247) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ifRVn-0005yP-RX for qemu-devel@nongnu.org; Thu, 12 Dec 2019 11:40:27 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ifRVj-0002M9-Oh for qemu-devel@nongnu.org; Thu, 12 Dec 2019 11:40:23 -0500 Received: from us-smtp-1.mimecast.com ([207.211.31.81]:55875 helo=us-smtp-delivery-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ifRVj-0002LO-Gh for qemu-devel@nongnu.org; Thu, 12 Dec 2019 11:40:19 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1576168819; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/k2Kkg+F22rORchvytoG+1DsaAbun0fKNxKknWwDxTE=; b=WI25YA53sFpd3+IXfzV6AboINtruSi36V8vN06gSxhAWqOmBq3p/QUizOWZKMqmIbX3nKD 9Aju1fm2FWOQnPkX3lye2NVVhSRZwirL3E6R5BRslzsCZE0Rj4QpZ3tqWoU4tvMFcHdAsp 8jQ+yXbthr8EAQmM3Ylmy7CBgcn57EI= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-237-vw0Ja8VFPtSVmMoigProQg-1; Thu, 12 Dec 2019 11:40:17 -0500 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id C85F81800D42 for ; Thu, 12 Dec 2019 16:40:16 +0000 (UTC) Received: from dgilbert-t580.localhost (ovpn-116-226.ams2.redhat.com [10.36.116.226]) by smtp.corp.redhat.com (Postfix) with ESMTP id E41DE60BE1; Thu, 12 Dec 2019 16:40:15 +0000 (UTC) From: "Dr. David Alan Gilbert (git)" To: qemu-devel@nongnu.org, stefanha@redhat.com, vgoyal@redhat.com Subject: [PATCH 043/104] virtiofsd: check input buffer size in fuse_lowlevel.c ops Date: Thu, 12 Dec 2019 16:38:03 +0000 Message-Id: <20191212163904.159893-44-dgilbert@redhat.com> In-Reply-To: <20191212163904.159893-1-dgilbert@redhat.com> References: <20191212163904.159893-1-dgilbert@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-MC-Unique: vw0Ja8VFPtSVmMoigProQg-1 X-Mimecast-Spam-Score: 0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 207.211.31.81 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" From: Stefan Hajnoczi Each FUSE operation involves parsing the input buffer. Currently the code assumes the input buffer is large enough for the expected arguments. This patch uses fuse_mbuf_iter to check the size. Most operations are simple to convert. Some are more complicated due to variable-length inputs or different sizes depending on the protocol version. Signed-off-by: Stefan Hajnoczi Reviewed-by: Sergio Lopez --- tools/virtiofsd/fuse_lowlevel.c | 581 +++++++++++++++++++++++++------- 1 file changed, 456 insertions(+), 125 deletions(-) diff --git a/tools/virtiofsd/fuse_lowlevel.c b/tools/virtiofsd/fuse_lowlevel.c index 4b1777b991..bd5ca2f157 100644 --- a/tools/virtiofsd/fuse_lowlevel.c +++ b/tools/virtiofsd/fuse_lowlevel.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include @@ -26,7 +27,6 @@ #include -#define PARAM(inarg) (((char *)(inarg)) + sizeof(*(inarg))) #define OFFSET_MAX 0x7fffffffffffffffLL struct fuse_pollhandle { @@ -708,9 +708,14 @@ int fuse_reply_lseek(fuse_req_t req, off_t off) return send_reply_ok(req, &arg, sizeof(arg)); } -static void do_lookup(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_lookup(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - char *name = (char *)inarg; + const char *name = fuse_mbuf_iter_advance_str(iter); + if (!name) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.lookup) { req->se->op.lookup(req, nodeid, name); @@ -719,9 +724,16 @@ static void do_lookup(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_forget(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_forget(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_forget_in *arg = (struct fuse_forget_in *)inarg; + struct fuse_forget_in *arg; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.forget) { req->se->op.forget(req, nodeid, arg->nlookup); @@ -731,20 +743,48 @@ static void do_forget(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } static void do_batch_forget(fuse_req_t req, fuse_ino_t nodeid, - const void *inarg) + struct fuse_mbuf_iter *iter) { - struct fuse_batch_forget_in *arg = (void *)inarg; - struct fuse_forget_one *param = (void *)PARAM(arg); - unsigned int i; + struct fuse_batch_forget_in *arg; + struct fuse_forget_data *forgets; + size_t scount; (void)nodeid; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_none(req); + return; + } + + /* + * Prevent integer overflow. The compiler emits the following warning + * unless we use the scount local variable: + * + * error: comparison is always false due to limited range of data type + * [-Werror=type-limits] + * + * This may be true on 64-bit hosts but we need this check for 32-bit + * hosts. + */ + scount = arg->count; + if (scount > SIZE_MAX / sizeof(forgets[0])) { + fuse_reply_none(req); + return; + } + + forgets = fuse_mbuf_iter_advance(iter, arg->count * sizeof(forgets[0])); + if (!forgets) { + fuse_reply_none(req); + return; + } + if (req->se->op.forget_multi) { - req->se->op.forget_multi(req, arg->count, - (struct fuse_forget_data *)param); + req->se->op.forget_multi(req, arg->count, forgets); } else if (req->se->op.forget) { + unsigned int i; + for (i = 0; i < arg->count; i++) { - struct fuse_forget_one *forget = ¶m[i]; struct fuse_req *dummy_req; dummy_req = fuse_ll_alloc_req(req->se); @@ -756,7 +796,7 @@ static void do_batch_forget(fuse_req_t req, fuse_ino_t nodeid, dummy_req->ctx = req->ctx; dummy_req->ch = NULL; - req->se->op.forget(dummy_req, forget->nodeid, forget->nlookup); + req->se->op.forget(dummy_req, forgets[i].ino, forgets[i].nlookup); } fuse_reply_none(req); } else { @@ -764,12 +804,19 @@ static void do_batch_forget(fuse_req_t req, fuse_ino_t nodeid, } } -static void do_getattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_getattr(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { struct fuse_file_info *fip = NULL; struct fuse_file_info fi; - struct fuse_getattr_in *arg = (struct fuse_getattr_in *)inarg; + struct fuse_getattr_in *arg; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } if (arg->getattr_flags & FUSE_GETATTR_FH) { memset(&fi, 0, sizeof(fi)); @@ -784,14 +831,21 @@ static void do_getattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_setattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_setattr(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_setattr_in *arg = (struct fuse_setattr_in *)inarg; - if (req->se->op.setattr) { + struct fuse_setattr_in *arg; struct fuse_file_info *fi = NULL; struct fuse_file_info fi_store; struct stat stbuf; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&stbuf, 0, sizeof(stbuf)); convert_attr(arg, &stbuf); if (arg->valid & FATTR_FH) { @@ -812,9 +866,16 @@ static void do_setattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_access(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_access(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_access_in *arg = (struct fuse_access_in *)inarg; + struct fuse_access_in *arg; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.access) { req->se->op.access(req, nodeid, arg->mask); @@ -823,9 +884,10 @@ static void do_access(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_readlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_readlink(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - (void)inarg; + (void)iter; if (req->se->op.readlink) { req->se->op.readlink(req, nodeid); @@ -834,10 +896,18 @@ static void do_readlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_mknod(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_mknod(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_mknod_in *arg = (struct fuse_mknod_in *)inarg; - char *name = PARAM(arg); + struct fuse_mknod_in *arg; + const char *name; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + name = fuse_mbuf_iter_advance_str(iter); + if (!arg || !name) { + fuse_reply_err(req, EINVAL); + return; + } req->ctx.umask = arg->umask; @@ -848,22 +918,37 @@ static void do_mknod(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_mkdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_mkdir(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_mkdir_in *arg = (struct fuse_mkdir_in *)inarg; + struct fuse_mkdir_in *arg; + const char *name; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + name = fuse_mbuf_iter_advance_str(iter); + if (!arg || !name) { + fuse_reply_err(req, EINVAL); + return; + } req->ctx.umask = arg->umask; if (req->se->op.mkdir) { - req->se->op.mkdir(req, nodeid, PARAM(arg), arg->mode); + req->se->op.mkdir(req, nodeid, name, arg->mode); } else { fuse_reply_err(req, ENOSYS); } } -static void do_unlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_unlink(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - char *name = (char *)inarg; + const char *name = fuse_mbuf_iter_advance_str(iter); + + if (!name) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.unlink) { req->se->op.unlink(req, nodeid, name); @@ -872,9 +957,15 @@ static void do_unlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_rmdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_rmdir(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - char *name = (char *)inarg; + const char *name = fuse_mbuf_iter_advance_str(iter); + + if (!name) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.rmdir) { req->se->op.rmdir(req, nodeid, name); @@ -883,10 +974,16 @@ static void do_rmdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_symlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_symlink(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - char *name = (char *)inarg; - char *linkname = ((char *)inarg) + strlen((char *)inarg) + 1; + const char *name = fuse_mbuf_iter_advance_str(iter); + const char *linkname = fuse_mbuf_iter_advance_str(iter); + + if (!name || !linkname) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.symlink) { req->se->op.symlink(req, linkname, nodeid, name); @@ -895,11 +992,20 @@ static void do_symlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_rename(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_rename(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_rename_in *arg = (struct fuse_rename_in *)inarg; - char *oldname = PARAM(arg); - char *newname = oldname + strlen(oldname) + 1; + struct fuse_rename_in *arg; + const char *oldname; + const char *newname; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + oldname = fuse_mbuf_iter_advance_str(iter); + newname = fuse_mbuf_iter_advance_str(iter); + if (!arg || !oldname || !newname) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.rename) { req->se->op.rename(req, nodeid, oldname, arg->newdir, newname, 0); @@ -908,11 +1014,20 @@ static void do_rename(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_rename2(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_rename2(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_rename2_in *arg = (struct fuse_rename2_in *)inarg; - char *oldname = PARAM(arg); - char *newname = oldname + strlen(oldname) + 1; + struct fuse_rename2_in *arg; + const char *oldname; + const char *newname; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + oldname = fuse_mbuf_iter_advance_str(iter); + newname = fuse_mbuf_iter_advance_str(iter); + if (!arg || !oldname || !newname) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.rename) { req->se->op.rename(req, nodeid, oldname, arg->newdir, newname, @@ -922,24 +1037,38 @@ static void do_rename2(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_link(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_link(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_link_in *arg = (struct fuse_link_in *)inarg; + struct fuse_link_in *arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + const char *name = fuse_mbuf_iter_advance_str(iter); + + if (!arg || !name) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.link) { - req->se->op.link(req, arg->oldnodeid, nodeid, PARAM(arg)); + req->se->op.link(req, arg->oldnodeid, nodeid, name); } else { fuse_reply_err(req, ENOSYS); } } -static void do_create(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_create(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_create_in *arg = (struct fuse_create_in *)inarg; - if (req->se->op.create) { + struct fuse_create_in *arg; struct fuse_file_info fi; - char *name = PARAM(arg); + const char *name; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + name = fuse_mbuf_iter_advance_str(iter); + if (!arg || !name) { + fuse_reply_err(req, EINVAL); + return; + } memset(&fi, 0, sizeof(fi)); fi.flags = arg->flags; @@ -952,11 +1081,18 @@ static void do_create(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_open(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_open(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_open_in *arg = (struct fuse_open_in *)inarg; + struct fuse_open_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.flags = arg->flags; @@ -967,13 +1103,15 @@ static void do_open(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_read(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_read(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_read_in *arg = (struct fuse_read_in *)inarg; - if (req->se->op.read) { + struct fuse_read_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; fi.lock_owner = arg->lock_owner; @@ -984,11 +1122,24 @@ static void do_read(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_write(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_write(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_write_in *arg = (struct fuse_write_in *)inarg; + struct fuse_write_in *arg; struct fuse_file_info fi; - char *param; + const char *param; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + + param = fuse_mbuf_iter_advance(iter, arg->size); + if (!param) { + fuse_reply_err(req, EINVAL); + return; + } memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; @@ -996,7 +1147,6 @@ static void do_write(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) fi.lock_owner = arg->lock_owner; fi.flags = arg->flags; - param = PARAM(arg); if (req->se->op.write) { req->se->op.write(req, nodeid, param, arg->size, arg->offset, &fi); @@ -1054,11 +1204,18 @@ static void do_write_buf(fuse_req_t req, fuse_ino_t nodeid, se->op.write_buf(req, nodeid, pbufv, arg->offset, &fi); } -static void do_flush(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_flush(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_flush_in *arg = (struct fuse_flush_in *)inarg; + struct fuse_flush_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; fi.flush = 1; @@ -1071,19 +1228,26 @@ static void do_flush(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_release(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_release(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_release_in *arg = (struct fuse_release_in *)inarg; + struct fuse_release_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.flags = arg->flags; fi.fh = arg->fh; fi.flush = (arg->release_flags & FUSE_RELEASE_FLUSH) ? 1 : 0; fi.lock_owner = arg->lock_owner; + if (arg->release_flags & FUSE_RELEASE_FLOCK_UNLOCK) { fi.flock_release = 1; - fi.lock_owner = arg->lock_owner; } if (req->se->op.release) { @@ -1093,11 +1257,19 @@ static void do_release(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_fsync(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_fsync(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_fsync_in *arg = (struct fuse_fsync_in *)inarg; + struct fuse_fsync_in *arg; struct fuse_file_info fi; - int datasync = arg->fsync_flags & 1; + int datasync; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + datasync = arg->fsync_flags & 1; memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; @@ -1113,11 +1285,18 @@ static void do_fsync(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_opendir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_opendir(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_open_in *arg = (struct fuse_open_in *)inarg; + struct fuse_open_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.flags = arg->flags; @@ -1128,11 +1307,18 @@ static void do_opendir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_readdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_readdir(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_read_in *arg = (struct fuse_read_in *)inarg; + struct fuse_read_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; @@ -1143,11 +1329,18 @@ static void do_readdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_readdirplus(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_readdirplus(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_read_in *arg = (struct fuse_read_in *)inarg; + struct fuse_read_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; @@ -1158,11 +1351,18 @@ static void do_readdirplus(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_releasedir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_releasedir(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_release_in *arg = (struct fuse_release_in *)inarg; + struct fuse_release_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.flags = arg->flags; fi.fh = arg->fh; @@ -1174,11 +1374,19 @@ static void do_releasedir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_fsyncdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_fsyncdir(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_fsync_in *arg = (struct fuse_fsync_in *)inarg; + struct fuse_fsync_in *arg; struct fuse_file_info fi; - int datasync = arg->fsync_flags & 1; + int datasync; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + datasync = arg->fsync_flags & 1; memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; @@ -1190,10 +1398,11 @@ static void do_fsyncdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_statfs(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_statfs(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { (void)nodeid; - (void)inarg; + (void)iter; if (req->se->op.statfs) { req->se->op.statfs(req, nodeid); @@ -1206,11 +1415,25 @@ static void do_statfs(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_setxattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_setxattr(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_setxattr_in *arg = (struct fuse_setxattr_in *)inarg; - char *name = PARAM(arg); - char *value = name + strlen(name) + 1; + struct fuse_setxattr_in *arg; + const char *name; + const char *value; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + name = fuse_mbuf_iter_advance_str(iter); + if (!arg || !name) { + fuse_reply_err(req, EINVAL); + return; + } + + value = fuse_mbuf_iter_advance(iter, arg->size); + if (!value) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.setxattr) { req->se->op.setxattr(req, nodeid, name, value, arg->size, arg->flags); @@ -1219,20 +1442,36 @@ static void do_setxattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_getxattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_getxattr(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_getxattr_in *arg = (struct fuse_getxattr_in *)inarg; + struct fuse_getxattr_in *arg; + const char *name; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + name = fuse_mbuf_iter_advance_str(iter); + if (!arg || !name) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.getxattr) { - req->se->op.getxattr(req, nodeid, PARAM(arg), arg->size); + req->se->op.getxattr(req, nodeid, name, arg->size); } else { fuse_reply_err(req, ENOSYS); } } -static void do_listxattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_listxattr(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_getxattr_in *arg = (struct fuse_getxattr_in *)inarg; + struct fuse_getxattr_in *arg; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.listxattr) { req->se->op.listxattr(req, nodeid, arg->size); @@ -1241,9 +1480,15 @@ static void do_listxattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_removexattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_removexattr(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - char *name = (char *)inarg; + const char *name = fuse_mbuf_iter_advance_str(iter); + + if (!name) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.removexattr) { req->se->op.removexattr(req, nodeid, name); @@ -1267,12 +1512,19 @@ static void convert_fuse_file_lock(struct fuse_file_lock *fl, flock->l_pid = fl->pid; } -static void do_getlk(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_getlk(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_lk_in *arg = (struct fuse_lk_in *)inarg; + struct fuse_lk_in *arg; struct fuse_file_info fi; struct flock flock; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; fi.lock_owner = arg->owner; @@ -1286,12 +1538,18 @@ static void do_getlk(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } static void do_setlk_common(fuse_req_t req, fuse_ino_t nodeid, - const void *inarg, int sleep) + struct fuse_mbuf_iter *iter, int sleep) { - struct fuse_lk_in *arg = (struct fuse_lk_in *)inarg; + struct fuse_lk_in *arg; struct fuse_file_info fi; struct flock flock; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; fi.lock_owner = arg->owner; @@ -1329,14 +1587,16 @@ static void do_setlk_common(fuse_req_t req, fuse_ino_t nodeid, } } -static void do_setlk(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_setlk(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - do_setlk_common(req, nodeid, inarg, 0); + do_setlk_common(req, nodeid, iter, 0); } -static void do_setlkw(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_setlkw(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - do_setlk_common(req, nodeid, inarg, 1); + do_setlk_common(req, nodeid, iter, 1); } static int find_interrupted(struct fuse_session *se, struct fuse_req *req) @@ -1381,12 +1641,20 @@ static int find_interrupted(struct fuse_session *se, struct fuse_req *req) return 0; } -static void do_interrupt(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_interrupt(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_interrupt_in *arg = (struct fuse_interrupt_in *)inarg; + struct fuse_interrupt_in *arg; struct fuse_session *se = req->se; (void)nodeid; + + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + if (se->debug) { fuse_log(FUSE_LOG_DEBUG, "INTERRUPT: %llu\n", (unsigned long long)arg->unique); @@ -1427,9 +1695,15 @@ static struct fuse_req *check_interrupt(struct fuse_session *se, } } -static void do_bmap(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_bmap(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_bmap_in *arg = (struct fuse_bmap_in *)inarg; + struct fuse_bmap_in *arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } if (req->se->op.bmap) { req->se->op.bmap(req, nodeid, arg->blocksize, arg->block); @@ -1438,18 +1712,34 @@ static void do_bmap(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_ioctl(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_ioctl(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_ioctl_in *arg = (struct fuse_ioctl_in *)inarg; - unsigned int flags = arg->flags; - void *in_buf = arg->in_size ? PARAM(arg) : NULL; + struct fuse_ioctl_in *arg; + unsigned int flags; + void *in_buf = NULL; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + + flags = arg->flags; if (flags & FUSE_IOCTL_DIR && !(req->se->conn.want & FUSE_CAP_IOCTL_DIR)) { fuse_reply_err(req, ENOTTY); return; } + if (arg->in_size) { + in_buf = fuse_mbuf_iter_advance(iter, arg->in_size); + if (!in_buf) { + fuse_reply_err(req, EINVAL); + return; + } + } + memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; @@ -1470,11 +1760,18 @@ void fuse_pollhandle_destroy(struct fuse_pollhandle *ph) free(ph); } -static void do_poll(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_poll(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_poll_in *arg = (struct fuse_poll_in *)inarg; + struct fuse_poll_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; fi.poll_events = arg->events; @@ -1498,11 +1795,18 @@ static void do_poll(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_fallocate(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_fallocate(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_fallocate_in *arg = (struct fuse_fallocate_in *)inarg; + struct fuse_fallocate_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; @@ -1515,12 +1819,17 @@ static void do_fallocate(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } static void do_copy_file_range(fuse_req_t req, fuse_ino_t nodeid_in, - const void *inarg) + struct fuse_mbuf_iter *iter) { - struct fuse_copy_file_range_in *arg = - (struct fuse_copy_file_range_in *)inarg; + struct fuse_copy_file_range_in *arg; struct fuse_file_info fi_in, fi_out; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + memset(&fi_in, 0, sizeof(fi_in)); fi_in.fh = arg->fh_in; @@ -1537,11 +1846,17 @@ static void do_copy_file_range(fuse_req_t req, fuse_ino_t nodeid_in, } } -static void do_lseek(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_lseek(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_lseek_in *arg = (struct fuse_lseek_in *)inarg; + struct fuse_lseek_in *arg; struct fuse_file_info fi; + arg = fuse_mbuf_iter_advance(iter, sizeof(*arg)); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } memset(&fi, 0, sizeof(fi)); fi.fh = arg->fh; @@ -1552,15 +1867,33 @@ static void do_lseek(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) } } -static void do_init(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_init(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { - struct fuse_init_in *arg = (struct fuse_init_in *)inarg; + size_t compat_size = offsetof(struct fuse_init_in, max_readahead); + struct fuse_init_in *arg; struct fuse_init_out outarg; struct fuse_session *se = req->se; size_t bufsize = se->bufsize; size_t outargsize = sizeof(outarg); (void)nodeid; + + /* First consume the old fields... */ + arg = fuse_mbuf_iter_advance(iter, compat_size); + if (!arg) { + fuse_reply_err(req, EINVAL); + return; + } + + /* ...and now consume the new fields. */ + if (arg->major == 7 && arg->minor >= 6) { + if (!fuse_mbuf_iter_advance(iter, sizeof(*arg) - compat_size)) { + fuse_reply_err(req, EINVAL); + return; + } + } + if (se->debug) { fuse_log(FUSE_LOG_DEBUG, "INIT: %u.%u\n", arg->major, arg->minor); if (arg->major == 7 && arg->minor >= 6) { @@ -1793,12 +2126,13 @@ static void do_init(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) send_reply_ok(req, &outarg, outargsize); } -static void do_destroy(fuse_req_t req, fuse_ino_t nodeid, const void *inarg) +static void do_destroy(fuse_req_t req, fuse_ino_t nodeid, + struct fuse_mbuf_iter *iter) { struct fuse_session *se = req->se; (void)nodeid; - (void)inarg; + (void)iter; se->got_destroy = 1; if (se->op.destroy) { @@ -1979,7 +2313,7 @@ int fuse_req_interrupted(fuse_req_t req) } static struct { - void (*func)(fuse_req_t, fuse_ino_t, const void *); + void (*func)(fuse_req_t, fuse_ino_t, struct fuse_mbuf_iter *); const char *name; } fuse_ll_ops[] = { [FUSE_LOOKUP] = { do_lookup, "LOOKUP" }, @@ -2063,7 +2397,6 @@ void fuse_session_process_buf_int(struct fuse_session *se, const struct fuse_buf *buf = bufv->buf; struct fuse_mbuf_iter iter = FUSE_MBUF_ITER_INIT(buf); struct fuse_in_header *in; - const void *inarg; struct fuse_req *req; int err; @@ -2141,13 +2474,11 @@ void fuse_session_process_buf_int(struct fuse_session *se, } } - inarg = (void *)&in[1]; if (in->opcode == FUSE_WRITE && se->op.write_buf) { do_write_buf(req, in->nodeid, &iter, bufv); } else { - fuse_ll_ops[in->opcode].func(req, in->nodeid, inarg); + fuse_ll_ops[in->opcode].func(req, in->nodeid, &iter); } - return; reply_err: