From nobody Wed Dec 17 21:14:51 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 64539C77B7C for ; Tue, 18 Apr 2023 01:42:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230501AbjDRBmS (ORCPT ); Mon, 17 Apr 2023 21:42:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230417AbjDRBlo (ORCPT ); Mon, 17 Apr 2023 21:41:44 -0400 Received: from mail-yb1-xb4a.google.com (mail-yb1-xb4a.google.com [IPv6:2607:f8b0:4864:20::b4a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C1516729D for ; Mon, 17 Apr 2023 18:41:12 -0700 (PDT) Received: by mail-yb1-xb4a.google.com with SMTP id t66-20020a254645000000b00b74680a7904so25429632yba.15 for ; Mon, 17 Apr 2023 18:41:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1681782071; x=1684374071; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=w19M7mxJAre5VfcOLhOZhg9JC6HtCZspBwvR3oTaBtM=; b=O/uzOqnDmS58QEJVz0T7PNXTX0Mtqd93rP+7E7na6jJ7QBcC3+3JWqA624W+JCI64R g5UeaSIEQ2e9zoM9bLjzbRQ4TX4IcKtelfNTRYpmePqs0g/0s18ad9gEBxKqugTmTnXJ LzySXi8ehZLsjwTOWb1Bm2cDRdGh9W+hMegnr4ssDEOtKk1HcW9S90nfvbwuqyU9afp8 r/LRBntSZet4HdYZYg9L+SpnqePNzq+J51zllKN3K7oc10u2cosiIPhI7KlqZt97mhR3 m9YfjttiB71iUr6bziRAvbTY79chCtR9d3tTTN8GEdsXPPkdN4l+BdlYow6MfQfY3GLw IdrQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1681782071; x=1684374071; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=w19M7mxJAre5VfcOLhOZhg9JC6HtCZspBwvR3oTaBtM=; b=N0UYqChq2wTlHvoSV0CZ52QydCcQnS8L7QN0GjtzNPXpDn0x4WowWSnuQXPHmpO0/b 66jGXj3V5oFDP9Bk5P8hWP2lfRU7dDphMZsVynLFuaKH9ukZF5H/on/NGXpNSX0SLOMf Ip14pR6sVJoQJiYmMI5BOtRzWv6p17+vINH4T3lxoWkR1KiE1z8Ztmr7+LING8sEz+cA Y5Eoxr4JXwzVOfuiIpIeEIamhKgnZq3oR370zsTH+0W7Td+sjoaMb4EyRu5BzLOJOX+a q90yTIv7K9aeKQZEyVgn2sB/KT8F/ZcMgtdB8w+UjkDNSpqCL/xGgZxrfdtYF0qO85lw kafQ== X-Gm-Message-State: AAQBX9dKBoymPak4k4PBSeyLoruCnTg4dsrCQBARYRVTHA6i3+wVaStn tn0PZ9ZVvwskjwLnWk1nw4e1NDSYF5o= X-Google-Smtp-Source: AKy350YsucDg8BHeY6V0IoVOR0pulMc5pZV3Sps9tjCFUe04Pre+til+90iCxm0xGbwDMnHRM3ERPECUwNE= X-Received: from drosen.mtv.corp.google.com ([2620:15c:211:201:e67a:98b0:942d:86aa]) (user=drosen job=sendgmr) by 2002:a25:cbd5:0:b0:b95:630:197b with SMTP id b204-20020a25cbd5000000b00b950630197bmr691791ybg.10.1681782071432; Mon, 17 Apr 2023 18:41:11 -0700 (PDT) Date: Mon, 17 Apr 2023 18:40:09 -0700 In-Reply-To: <20230418014037.2412394-1-drosen@google.com> Mime-Version: 1.0 References: <20230418014037.2412394-1-drosen@google.com> X-Mailer: git-send-email 2.40.0.634.g4ca3ef3211-goog Message-ID: <20230418014037.2412394-10-drosen@google.com> Subject: [RFC PATCH v3 09/37] fuse-bpf: Add ioctl interface for /dev/fuse From: Daniel Rosenberg To: Miklos Szeredi , bpf@vger.kernel.org, Alexei Starovoitov Cc: Amir Goldstein , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-unionfs@vger.kernel.org, Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Jonathan Corbet , Joanne Koong , Mykola Lysenko , kernel-team@android.com, Daniel Rosenberg Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This introduces an alternative method of responding to fuse requests. Lookups supplying a backing fd or bpf will need to call through the ioctl to ensure there can be no attempts to fool priveledged processes into inadvertantly performing other actions. Signed-off-by: Daniel Rosenberg --- fs/fuse/dev.c | 56 ++++++++++++++++++++++++++++++++------- fs/fuse/fuse_i.h | 1 + include/uapi/linux/fuse.h | 1 + 3 files changed, 48 insertions(+), 10 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index a3029824c24f..ad7d9d1e6da5 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -1016,18 +1016,19 @@ static int fuse_copy_one(struct fuse_copy_state *cs= , void *val, unsigned size) =20 /* Copy the fuse-bpf lookup args and verify them */ #ifdef CONFIG_FUSE_BPF -static int fuse_copy_lookup(struct fuse_copy_state *cs, void *val, unsigne= d size) +static int fuse_copy_lookup(struct fuse_copy_state *cs, unsigned via_ioctl= , void *val, unsigned size) { struct fuse_bpf_entry_out *fbeo =3D (struct fuse_bpf_entry_out *)val; struct fuse_bpf_entry *feb =3D container_of(fbeo, struct fuse_bpf_entry, = out[0]); int num_entries =3D size / sizeof(*fbeo); int err; =20 - if (size && size % sizeof(*fbeo) !=3D 0) + if (size && (size % sizeof(*fbeo) !=3D 0 || !via_ioctl)) return -EINVAL; =20 if (num_entries > FUSE_BPF_MAX_ENTRIES) return -EINVAL; + err =3D fuse_copy_one(cs, val, size); if (err) return err; @@ -1036,7 +1037,7 @@ static int fuse_copy_lookup(struct fuse_copy_state *c= s, void *val, unsigned size return err; } #else -static int fuse_copy_lookup(struct fuse_copy_state *cs, void *val, unsigne= d size) +static int fuse_copy_lookup(struct fuse_copy_state *cs, unsigned via_ioctl= , void *val, unsigned size) { return fuse_copy_one(cs, val, size); } @@ -1045,7 +1046,7 @@ static int fuse_copy_lookup(struct fuse_copy_state *c= s, void *val, unsigned size /* Copy request arguments to/from userspace buffer */ static int fuse_copy_args(struct fuse_copy_state *cs, unsigned numargs, unsigned argpages, struct fuse_arg *args, - int zeroing, unsigned is_lookup) + int zeroing, unsigned is_lookup, unsigned via_ioct) { int err =3D 0; unsigned i; @@ -1055,7 +1056,7 @@ static int fuse_copy_args(struct fuse_copy_state *cs,= unsigned numargs, if (i =3D=3D numargs - 1 && argpages) err =3D fuse_copy_pages(cs, arg->size, zeroing); else if (i =3D=3D numargs - 1 && is_lookup) - err =3D fuse_copy_lookup(cs, arg->value, arg->size); + err =3D fuse_copy_lookup(cs, via_ioct, arg->value, arg->size); else err =3D fuse_copy_one(cs, arg->value, arg->size); } @@ -1333,7 +1334,7 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud,= struct file *file, err =3D fuse_copy_one(cs, &req->in.h, sizeof(req->in.h)); if (!err) err =3D fuse_copy_args(cs, args->in_numargs, args->in_pages, - (struct fuse_arg *) args->in_args, 0, 0); + (struct fuse_arg *) args->in_args, 0, 0, 0); fuse_copy_finish(cs); spin_lock(&fpq->lock); clear_bit(FR_LOCKED, &req->flags); @@ -1872,7 +1873,8 @@ static int copy_out_args(struct fuse_copy_state *cs, = struct fuse_args *args, lastarg->size -=3D diffsize; } return fuse_copy_args(cs, args->out_numargs, args->out_pages, - args->out_args, args->page_zeroing, args->is_lookup); + args->out_args, args->page_zeroing, args->is_lookup, + args->via_ioctl); } =20 /* @@ -1882,7 +1884,7 @@ static int copy_out_args(struct fuse_copy_state *cs, = struct fuse_args *args, * it from the list and copy the rest of the buffer to the request. * The request is finished by calling fuse_request_end(). */ -static ssize_t fuse_dev_do_write(struct fuse_dev *fud, +static ssize_t fuse_dev_do_write(struct fuse_dev *fud, bool from_ioctl, struct fuse_copy_state *cs, size_t nbytes) { int err; @@ -1954,6 +1956,7 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud, if (!req->args->page_replace) cs->move_pages =3D 0; =20 + req->args->via_ioctl =3D from_ioctl; if (oh.error) err =3D nbytes !=3D sizeof(oh) ? -EINVAL : 0; else @@ -1992,7 +1995,7 @@ static ssize_t fuse_dev_write(struct kiocb *iocb, str= uct iov_iter *from) =20 fuse_copy_init(&cs, 0, from); =20 - return fuse_dev_do_write(fud, &cs, iov_iter_count(from)); + return fuse_dev_do_write(fud, false, &cs, iov_iter_count(from)); } =20 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, @@ -2073,7 +2076,7 @@ static ssize_t fuse_dev_splice_write(struct pipe_inod= e_info *pipe, if (flags & SPLICE_F_MOVE) cs.move_pages =3D 1; =20 - ret =3D fuse_dev_do_write(fud, &cs, len); + ret =3D fuse_dev_do_write(fud, false, &cs, len); =20 pipe_lock(pipe); out_free: @@ -2286,6 +2289,33 @@ static int fuse_device_clone(struct fuse_conn *fc, s= truct file *new) return 0; } =20 +// Provides an alternate means to respond to a fuse request +static int fuse_handle_ioc_response(struct fuse_dev *dev, void *buff, uint= 32_t size) +{ + struct fuse_copy_state cs; + struct iovec *iov =3D NULL; + struct iov_iter iter; + int res; + + if (size > PAGE_SIZE) + return -EINVAL; + iov =3D (struct iovec *) __get_free_page(GFP_KERNEL); + if (!iov) + return -ENOMEM; + + iov->iov_base =3D buff; + iov->iov_len =3D size; + + iov_iter_init(&iter, READ, iov, 1, size); + fuse_copy_init(&cs, 0, &iter); + + + res =3D fuse_dev_do_write(dev, true, &cs, size); + free_page((unsigned long) iov); + + return res; +} + static long fuse_dev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { @@ -2318,6 +2348,12 @@ static long fuse_dev_ioctl(struct file *file, unsign= ed int cmd, } break; default: + if (_IOC_TYPE(cmd) =3D=3D FUSE_DEV_IOC_MAGIC + && _IOC_NR(cmd) =3D=3D _IOC_NR(FUSE_DEV_IOC_BPF_RESPONSE(0)) + && _IOC_DIR(cmd) =3D=3D _IOC_WRITE) { + res =3D fuse_handle_ioc_response(fuse_get_dev(file), (void *) arg, _IOC= _SIZE(cmd)); + break; + } res =3D -ENOTTY; break; } diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index c24878f4a89f..39a9fdf2a752 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -316,6 +316,7 @@ struct fuse_args { bool may_block:1; bool is_ext:1; bool is_lookup:1; + bool via_ioctl:1; struct fuse_in_arg in_args[3]; struct fuse_arg out_args[2]; void (*end)(struct fuse_mount *fm, struct fuse_args *args, int error); diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h index 04d96f34e9a1..3ad725a3e968 100644 --- a/include/uapi/linux/fuse.h +++ b/include/uapi/linux/fuse.h @@ -1012,6 +1012,7 @@ struct fuse_notify_retrieve_in { /* Device ioctls: */ #define FUSE_DEV_IOC_MAGIC 229 #define FUSE_DEV_IOC_CLONE _IOR(FUSE_DEV_IOC_MAGIC, 0, uint32_t) +#define FUSE_DEV_IOC_BPF_RESPONSE(N) _IOW(FUSE_DEV_IOC_MAGIC, 125, char[N]) =20 struct fuse_lseek_in { uint64_t fh; --=20 2.40.0.634.g4ca3ef3211-goog