ceph: don't allow access to MDS-private inodes

[ Upstream commit d4f6b31d721779d91b5e2f8072478af73b196c34 ]

The MDS reserves a set of inodes for its own usage, and these should
never be accessible to clients. Add a new helper to vet a proposed
inode number against that range, and complain loudly and refuse to
create or look it up if it's in it.

Also, ensure that the MDS doesn't try to delegate inodes that are in
that range or lower. Print a warning if it does, and don't save the
range in the xarray.

URL: https://tracker.ceph.com/issues/49922
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index baa6368bece59a5077ce1d343ac8b8e91b4e8fa4..042bb4a02c0a23f5a4d7fd764ed9d686a32c9dde 100644 (file)
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -129,6 +129,10 @@ static struct inode *__lookup_inode(struct super_block *sb, u64 ino)
 
        vino.ino = ino;
        vino.snap = CEPH_NOSNAP;
+
+       if (ceph_vino_is_reserved(vino))
+               return ERR_PTR(-ESTALE);
+
        inode = ceph_find_inode(sb, vino);
        if (!inode) {
                struct ceph_mds_request *req;
@@ -214,6 +218,10 @@ static struct dentry *__snapfh_to_dentry(struct super_block *sb,
                vino.ino = sfh->ino;
                vino.snap = sfh->snapid;
        }
+
+       if (ceph_vino_is_reserved(vino))
+               return ERR_PTR(-ESTALE);
+
        inode = ceph_find_inode(sb, vino);
        if (inode)
                return d_obtain_alias(inode);

diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 790433cb849e96d5bb27edb428122ada5d7b7128..346fcdfcd3e912027272907bdf2e23b037fb1b38 100644 (file)
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -56,6 +56,9 @@ struct inode *ceph_get_inode(struct super_block *sb, struct ceph_vino vino)
 {
        struct inode *inode;
 
+       if (ceph_vino_is_reserved(vino))
+               return ERR_PTR(-EREMOTEIO);
+
        inode = iget5_locked(sb, (unsigned long)vino.ino, ceph_ino_compare,
                             ceph_set_ino_cb, &vino);
        if (!inode)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 8f1d7500a7ecb236d3610474dbf0b8d74981b0d5..d560752b764d803403f9f73e98e66b892a92eca4 100644 (file)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -433,6 +433,13 @@ static int ceph_parse_deleg_inos(void **p, void *end,
 
                ceph_decode_64_safe(p, end, start, bad);
                ceph_decode_64_safe(p, end, len, bad);
+
+               /* Don't accept a delegation of system inodes */
+               if (start < CEPH_INO_SYSTEM_BASE) {
+                       pr_warn_ratelimited("ceph: ignoring reserved inode range delegation (start=0x%llx len=0x%llx)\n",
+                                       start, len);
+                       continue;
+               }
                while (len--) {
                        int err = xa_insert(&s->s_delegated_inos, ino = start++,
                                            DELEGATED_INO_AVAILABLE,

diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 482473e4cce1ad6ae2f9dfa3e6423e9c10b00ef4..c33f744a8e11c7108e434819f3ea816da09983cb 100644 (file)
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -529,10 +529,34 @@ static inline int ceph_ino_compare(struct inode *inode, void *data)
                ci->i_vino.snap == pvino->snap;
 }
 
+/*
+ * The MDS reserves a set of inodes for its own usage. These should never
+ * be accessible by clients, and so the MDS has no reason to ever hand these
+ * out. The range is CEPH_MDS_INO_MDSDIR_OFFSET..CEPH_INO_SYSTEM_BASE.
+ *
+ * These come from src/mds/mdstypes.h in the ceph sources.
+ */
+#define CEPH_MAX_MDS           0x100
+#define CEPH_NUM_STRAY         10
+#define CEPH_MDS_INO_MDSDIR_OFFSET     (1 * CEPH_MAX_MDS)
+#define CEPH_INO_SYSTEM_BASE           ((6*CEPH_MAX_MDS) + (CEPH_MAX_MDS * CEPH_NUM_STRAY))
+
+static inline bool ceph_vino_is_reserved(const struct ceph_vino vino)
+{
+       if (vino.ino < CEPH_INO_SYSTEM_BASE &&
+           vino.ino >= CEPH_MDS_INO_MDSDIR_OFFSET) {
+               WARN_RATELIMIT(1, "Attempt to access reserved inode number 0x%llx", vino.ino);
+               return true;
+       }
+       return false;
+}
 
 static inline struct inode *ceph_find_inode(struct super_block *sb,
                                            struct ceph_vino vino)
 {
+       if (ceph_vino_is_reserved(vino))
+               return NULL;
+
        /*
         * NB: The hashval will be run through the fs/inode.c hash function
         * anyway, so there is no need to squash the inode number down to