“extend the lseek on dir”

Author: briteny-pwn

project/libfuse-fs/src/overlayfs/async_io.rs

@@ -908,8 +908,6 @@ impl Filesystem for OverlayFs {
         offset: u64,
         whence: u32,
     ) -> Result<ReplyLSeek> {
-        // can this be on dir? FIXME: assume file for now
-        // we need special process if it can be called on dir
         let node = self.lookup_node(req, inode, "").await?;
 
         if node.whiteout.load(Ordering::Relaxed) {
@@ -918,14 +916,73 @@ impl Filesystem for OverlayFs {
 
         let st = node.stat64(req).await?;
         if utils::is_dir(&st.attr.kind) {
-            error!("lseek on directory");
-            return Err(Error::from_raw_os_error(libc::EINVAL).into());
-        }
+            // Special handling and security restrictions for directory operations
+            let handles = self.handles.lock().await;
+            let handle_data = handles.get(&fh).ok_or_else(|| {
+                Error::new(ErrorKind::InvalidInput, "Invalid directory handle")
+            })?;
+
+            // Verify handle type and permissions
+            if let Some(ref rh) = handle_data.real_handle {
+                // Verify that this handle is indeed a directory handle
+                let handle_stat = if let Ok(stat) = rh.layer
+                    .getattr(req, rh.inode, Some(rh.handle.load(Ordering::Relaxed)), 0)
+                    .await
+                {
+                    stat
+                } else {
+                    return Err(Error::from_raw_os_error(libc::EBADF).into());
+                };
 
-        let (layer, real_inode, real_handle) = self.find_real_info_from_handle(fh).await?;
-        layer
-            .lseek(req, real_inode, real_handle, offset, whence)
-            .await
+                if !utils::is_dir(&handle_stat.attr.kind) {
+                    return Err(Error::from_raw_os_error(libc::ENOTDIR).into());
+                }
+
+                match whence {
+                    libc::SEEK_SET => {
+                        // Validate offset bounds
+                        if offset > i64::MAX as u64 {
+                            return Err(Error::from_raw_os_error(libc::EINVAL).into());
+                        }
+
+                        // Perform the seek operation
+                        rh.layer
+                            .lseek(req, rh.inode, rh.handle.load(Ordering::Relaxed), offset, whence)
+                            .await
+                    },
+                    libc::SEEK_CUR => {
+                        // Get current position
+                        let current = if let Ok(reply) = rh.layer
+                            .lseek(req, rh.inode, rh.handle.load(Ordering::Relaxed), 0, libc::SEEK_CUR)
+                            .await
+                        {
+                            reply.offset
+                        } else {
+                            return Err(Error::from_raw_os_error(libc::EINVAL).into());
+                        };
+
+                        // Check for potential overflow
+                        if let Some(new_offset) = current.checked_add(offset) {
+                            if new_offset > i64::MAX as u64 {
+                                return Err(Error::from_raw_os_error(libc::EINVAL).into());
+                            }
+                            Ok(ReplyLSeek { offset: new_offset })
+                        } else {
+                            Err(Error::from_raw_os_error(libc::EINVAL).into())
+                        }
+                    },
+                    _ => Err(Error::from_raw_os_error(libc::EINVAL).into()),
+                }
+            } else {
+                Err(Error::new(ErrorKind::InvalidInput, "Invalid directory handle").into())
+            }
+        } else {
+            // Keep the original lseek behavior for regular files
+            let (layer, real_inode, real_handle) = self.find_real_info_from_handle(fh).await?;
+            layer
+                .lseek(req, real_inode, real_handle, offset, whence)
+                .await
+        }
     }
 
     async fn interrupt(&self, _req: Request, _unique: u64) -> Result<()> {

project/libfuse-fs/src/passthrough/async_io.rs

@@ -1794,21 +1794,57 @@ impl Filesystem for PassthroughFs {
         // Let the Arc<HandleData> in scope, otherwise fd may get invalid.
         let data = self.handle_map.get(fh, inode).await?;
 
-        // Acquire the lock to get exclusive access, otherwise it may break do_readdir().
-        let (_guard, file) = data.get_file_mut().await;
+        // 检查文件类型
+        let st = stat_fd(data.get_file(), None)?;
+        let is_dir = (st.st_mode & libc::S_IFMT) == libc::S_IFDIR;
+
+        if is_dir {
+            match whence {
+                // 目录只支持 SEEK_SET
+                libc::SEEK_SET => {
+                    // 检查目录offset的有效性
+                    if offset > i64::MAX as u64 {
+                        return Err(io::Error::from_raw_os_error(libc::EINVAL).into());
+                    }
 
-        // Safe because this doesn't modify any memory and we check the return value.
-        let res = unsafe {
-            libc::lseek(
-                file.as_raw_fd(),
-                offset as libc::off64_t,
-                whence as libc::c_int,
-            )
-        };
-        if res < 0 {
-            Err(io::Error::last_os_error().into())
+                    // Acquire the lock to get exclusive access
+                    let (_guard, file) = data.get_file_mut().await;
+                    
+                    // 对目录的seek操作，特别注意安全边界
+                    let res = unsafe {
+                        libc::lseek64(
+                            file.as_raw_fd(),
+                            offset as libc::off64_t,
+                            libc::SEEK_SET,
+                        )
+                    };
+                    
+                    if res < 0 {
+                        return Err(io::Error::last_os_error().into());
+                    }
+                    Ok(ReplyLSeek { offset: res as u64 })
+                }
+                // 目录不支持其他seek类型
+                _ => Err(io::Error::from_raw_os_error(libc::EINVAL).into()),
+            }
         } else {
-            Ok(ReplyLSeek { offset: res as u64 })
+            // 文件的seek操作
+            // Acquire the lock to get exclusive access, otherwise it may break do_readdir().
+            let (_guard, file) = data.get_file_mut().await;
+
+            // Safe because this doesn't modify any memory and we check the return value.
+            let res = unsafe {
+                libc::lseek(
+                    file.as_raw_fd(),
+                    offset as libc::off64_t,
+                    whence as libc::c_int,
+                )
+            };
+            if res < 0 {
+                Err(io::Error::last_os_error().into())
+            } else {
+                Ok(ReplyLSeek { offset: res as u64 })
+            }
         }
     }
 }