handlers.go

// Copyright 2021 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package lisafs

import (
"fmt"
"math"
"strings"

"golang.org/x/sys/unix"
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/cleanup"
"gvisor.dev/gvisor/pkg/flipcall"
"gvisor.dev/gvisor/pkg/fspath"
"gvisor.dev/gvisor/pkg/log"
"gvisor.dev/gvisor/pkg/marshal/primitive"
"gvisor.dev/gvisor/pkg/p9"
)

const (
allowedOpenFlags=unix.O_ACCMODE|unix.O_TRUNC
setStatSupportedMask=unix.STATX_MODE|unix.STATX_UID|unix.STATX_GID|unix.STATX_SIZE|unix.STATX_ATIME|unix.STATX_MTIME
// unixDirentMaxSize is the maximum size of unix.Dirent for amd64.
unixDirentMaxSize=280
)

// RPCHandler defines a handler that is invoked when the associated message is
// received. The handler is responsible for:
//
// - Unmarshalling the request from the passed payload and interpreting it.
// - Marshalling the response into the communicator's payload buffer.
// - Return the number of payload bytes written.
// - Donate any FDs (if needed) to comm which will in turn donate it to client.
typeRPCHandlerfunc(c*Connection, commCommunicator, payloadLenuint32) (uint32, error)

varhandlers= [...]RPCHandler{
Error: ErrorHandler,
Mount: MountHandler,
Channel: ChannelHandler,
FStat: FStatHandler,
SetStat: SetStatHandler,
Walk: WalkHandler,
WalkStat: WalkStatHandler,
OpenAt: OpenAtHandler,
OpenCreateAt: OpenCreateAtHandler,
Close: CloseHandler,
FSync: FSyncHandler,
PWrite: PWriteHandler,
PRead: PReadHandler,
MkdirAt: MkdirAtHandler,
MknodAt: MknodAtHandler,
SymlinkAt: SymlinkAtHandler,
LinkAt: LinkAtHandler,
FStatFS: FStatFSHandler,
FAllocate: FAllocateHandler,
ReadLinkAt: ReadLinkAtHandler,
Flush: FlushHandler,
UnlinkAt: UnlinkAtHandler,
RenameAt: RenameAtHandler,
Getdents64: Getdents64Handler,
FGetXattr: FGetXattrHandler,
FSetXattr: FSetXattrHandler,
FListXattr: FListXattrHandler,
FRemoveXattr: FRemoveXattrHandler,
Connect: ConnectHandler,
BindAt: BindAtHandler,
Listen: ListenHandler,
Accept: AcceptHandler,
ConnectWithCreds: ConnectWithCredsHandler,
}

// ErrorHandler handles Error message.
funcErrorHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
// Client should never send Error.
return0, unix.EINVAL
}

// MountHandler handles the Mount RPC. Note that there can not be concurrent
// executions of MountHandler on a connection because the connection enforces
// that Mount is the first message on the connection. Only after the connection
// has been successfully mounted can other channels be created.
funcMountHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
var (
mountPointFD*ControlFD
mountPointHostFD=-1
mountPointStat linux.Statx
mountNode=c.server.root
 )
iferr:=c.server.withRenameReadLock(func() (errerror) {
// Maintain extra ref on mountNode to ensure existence during walk.
mountNode.IncRef()
deferfunc() {
// Drop extra ref on mountNode. Wrap the defer call with a func so that
// mountNode is evaluated on execution, not on defer itself.
mountNode.DecRef(nil)
 }()

// Walk to the mountpoint.
pit:=fspath.Parse(c.mountPath).Begin
forpit.Ok() {
curName:=pit.String()
iferr:=checkSafeName(curName); err!=nil {
returnerr
 }
mountNode.opMu.RLock()
ifmountNode.isDeleted() {
mountNode.opMu.RUnlock()
returnunix.ENOENT
 }
mountNode.childrenMu.Lock()
next:=mountNode.LookupChildLocked(curName)
ifnext==nil {
next=&Node{}
next.InitLocked(curName, mountNode)
 } else {
next.IncRef()
 }
mountNode.childrenMu.Unlock()
mountNode.opMu.RUnlock()
// next has an extra ref as needed. Drop extra ref on mountNode.
mountNode.DecRef(nil)
pit=pit.Next()
mountNode=next
 }

// Provide Mount with read concurrency guarantee.
mountNode.opMu.RLock()
defermountNode.opMu.RUnlock()
ifmountNode.isDeleted() {
returnunix.ENOENT
 }
mountPointFD, mountPointStat, mountPointHostFD, err=c.ServerImpl().Mount(c, mountNode)
returnerr
 }); err!=nil {
return0, err
 }

ifmountPointHostFD>=0 {
comm.DonateFD(mountPointHostFD)
 }
resp:=MountResp{
Root: Inode{
ControlFD: mountPointFD.id,
Stat: mountPointStat,
 },
SupportedMs: c.ServerImpl().SupportedMessages(),
MaxMessageSize: primitive.Uint32(c.ServerImpl().MaxMessageSize()),
 }
respPayloadLen:=uint32(resp.SizeBytes())
resp.MarshalBytes(comm.PayloadBuf(respPayloadLen))
returnrespPayloadLen, nil
}

// ChannelHandler handles the Channel RPC.
funcChannelHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
ch, desc, fdSock, err:=c.createChannel(c.ServerImpl().MaxMessageSize())
iferr!=nil {
return0, err
 }

// Start servicing the channel in a separate goroutine.
c.activeWg.Add(1)
gofunc() {
iferr:=c.service(ch); err!=nil {
// Don't log shutdown error which is expected during server shutdown.
if_, ok:=err.(flipcall.ShutdownError); !ok {
log.Warningf("lisafs.Connection.service(channel = @%p): %v", ch, err)
 }
 }
c.activeWg.Done()
 }()

clientDataFD, err:=unix.Dup(desc.FD)
iferr!=nil {
unix.Close(fdSock)
ch.shutdown()
return0, err
 }

// Respond to client with successful channel creation message.
comm.DonateFD(clientDataFD)
comm.DonateFD(fdSock)
resp:=ChannelResp{
dataOffset: desc.Offset,
dataLength: uint64(desc.Length),
 }
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// FStatHandler handles the FStat RPC.
funcFStatHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
varreqStatReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

fd, err:=c.lookupFD(req.FD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)

varresp linux.Statx
switcht:=fd.(type) {
case*ControlFD:
t.safelyRead(func() error {
resp, err=t.impl.Stat()
returnerr
 })
case*OpenFD:
t.controlFD.safelyRead(func() error {
resp, err=t.impl.Stat()
returnerr
 })
default:
panic(fmt.Sprintf("unknown fd type %T", t))
 }
iferr!=nil {
return0, err
 }
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// SetStatHandler handles the SetStat RPC.
funcSetStatHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
ifc.readonly {
return0, unix.EROFS
 }

varreqSetStatReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

fd, err:=c.lookupControlFD(req.FD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)

ifreq.Mask&^setStatSupportedMask!=0 {
return0, unix.EPERM
 }

varrespSetStatResp
iferr:=fd.safelyWrite(func() error {
iffd.node.isDeleted() &&!c.server.opts.SetAttrOnDeleted {
returnunix.EINVAL
 }
failureMask, failureErr:=fd.impl.SetStat(req)
resp.FailureMask=failureMask
iffailureErr!=nil {
resp.FailureErrNo=uint32(p9.ExtractErrno(failureErr))
 }
returnnil
 }); err!=nil {
return0, err
 }
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// WalkHandler handles the Walk RPC.
funcWalkHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
varreqWalkReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

startDir, err:=c.lookupControlFD(req.DirFD)
iferr!=nil {
return0, err
 }
deferstartDir.DecRef(nil)
if!startDir.IsDir() {
return0, unix.ENOTDIR
 }

// Manually marshal the inodes into the payload buffer during walk to avoid
// the slice allocation. The memory format should be WalkResp's.
var (
numInodes primitive.Uint16
status=WalkSuccess
 )
respMetaSize:=status.SizeBytes() +numInodes.SizeBytes()
maxPayloadSize:=respMetaSize+ (len(req.Path) * (*Inode)(nil).SizeBytes())
ifmaxPayloadSize>math.MaxUint32 {
// Too much to walk, can't do.
return0, unix.EIO
 }
payloadBuf:=comm.PayloadBuf(uint32(maxPayloadSize))
payloadPos:=respMetaSize
iferr:=c.server.withRenameReadLock(func() error {
curDir:=startDir
cu:=cleanup.Make(func() {
// Destroy all newly created FDs until now. Read the new FDIDs from the
// payload buffer.
buf:=comm.PayloadBuf(uint32(maxPayloadSize))[respMetaSize:]
varcurInoInode
fori:=0; i<int(numInodes); i++ {
buf=curIno.UnmarshalBytes(buf)
c.removeControlFDLocked(curIno.ControlFD)
 }
 })
defercu.Clean()

for_, name:=rangereq.Path {
iferr:=checkSafeName(name); err!=nil {
returnerr
 }
// Symlinks terminate walk. This client gets the symlink inode, but will
// have to invoke Walk again with the resolved path.
ifcurDir.IsSymlink() {
status=WalkComponentSymlink
break
 }
curDir.node.opMu.RLock()
ifcurDir.node.isDeleted() {
// It is not safe to walk on a deleted directory. It could have been
// replaced with a malicious symlink.
curDir.node.opMu.RUnlock()
status=WalkComponentDoesNotExist
break
 }
child, childStat, err:=curDir.impl.Walk(name)
curDir.node.opMu.RUnlock()
iferr==unix.ENOENT {
status=WalkComponentDoesNotExist
break
 }
iferr!=nil {
returnerr
 }
// Write inode into payload buffer.
i:=Inode{ControlFD: child.id, Stat: childStat}
i.MarshalUnsafe(payloadBuf[payloadPos:])
payloadPos+=i.SizeBytes()
numInodes++
curDir=child
 }
cu.Release()
returnnil
 }); err!=nil {
return0, err
 }

// WalkResp writes the walk status followed by the number of inodes in the
// beginning.
payloadBuf=status.MarshalUnsafe(payloadBuf)
numInodes.MarshalUnsafe(payloadBuf)
returnuint32(payloadPos), nil
}

// WalkStatHandler handles the WalkStat RPC.
funcWalkStatHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
varreqWalkReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

startDir, err:=c.lookupControlFD(req.DirFD)
iferr!=nil {
return0, err
 }
deferstartDir.DecRef(nil)

// Note that this fd is allowed to not actually be a directory when the
// only path component to walk is "" (self).
if!startDir.IsDir() {
iflen(req.Path) >1|| (len(req.Path) ==1&&len(req.Path[0]) >0) {
return0, unix.ENOTDIR
 }
 }
fori, name:=rangereq.Path {
// First component is allowed to be "".
ifi==0&&len(name) ==0 {
continue
 }
iferr:=checkSafeName(name); err!=nil {
return0, err
 }
 }

// We will manually marshal the statx results into the payload buffer as they
// are generated to avoid the slice allocation. The memory format should be
// the same as WalkStatResp's.
varnumStats primitive.Uint16
maxPayloadSize:=numStats.SizeBytes() + (len(req.Path) *linux.SizeOfStatx)
ifmaxPayloadSize>math.MaxUint32 {
// Too much to walk, can't do.
return0, unix.EIO
 }
payloadBuf:=comm.PayloadBuf(uint32(maxPayloadSize))
payloadPos:=numStats.SizeBytes()

ifc.server.opts.WalkStatSupported {
iferr=startDir.safelyRead(func() error {
returnstartDir.impl.WalkStat(req.Path, func(s linux.Statx) {
s.MarshalUnsafe(payloadBuf[payloadPos:])
payloadPos+=s.SizeBytes()
numStats++
 })
 }); err!=nil {
return0, err
 }
// WalkStatResp writes the number of stats in the beginning.
numStats.MarshalUnsafe(payloadBuf)
returnuint32(payloadPos), nil
 }

iferr=c.server.withRenameReadLock(func() error {
iflen(req.Path) >0&&len(req.Path[0]) ==0 {
startDir.node.opMu.RLock()
stat, err:=startDir.impl.Stat()
startDir.node.opMu.RUnlock()
iferr!=nil {
returnerr
 }
stat.MarshalUnsafe(payloadBuf[payloadPos:])
payloadPos+=stat.SizeBytes()
numStats++
req.Path=req.Path[1:]
 }

parent:=startDir
closeParent:=func() {
ifparent!=startDir {
c.removeControlFDLocked(parent.id)
 }
 }
defercloseParent()

for_, name:=rangereq.Path {
parent.node.opMu.RLock()
ifparent.node.isDeleted() {
// It is not safe to walk on a deleted directory. It could have been
// replaced with a malicious symlink.
parent.node.opMu.RUnlock()
break
 }
child, childStat, err:=parent.impl.Walk(name)
parent.node.opMu.RUnlock()
iferr!=nil {
iferr==unix.ENOENT {
break
 }
returnerr
 }

// Update with next generation.
closeParent()
parent=child

// Write results.
childStat.MarshalUnsafe(payloadBuf[payloadPos:])
payloadPos+=childStat.SizeBytes()
numStats++

// Symlinks terminate walk. This client gets the symlink stat result, but
// will have to invoke Walk again with the resolved path.
ifchildStat.Mode&unix.S_IFMT==unix.S_IFLNK {
break
 }
 }
returnnil
 }); err!=nil {
return0, err
 }

// WalkStatResp writes the number of stats in the beginning.
numStats.MarshalUnsafe(payloadBuf)
returnuint32(payloadPos), nil
}

// OpenAtHandler handles the OpenAt RPC.
funcOpenAtHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
varreqOpenAtReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

// Only keep allowed open flags.
ifallowedFlags:=req.Flags&allowedOpenFlags; allowedFlags!=req.Flags {
log.Debugf("discarding open flags that are not allowed: old open flags = %d, new open flags = %d", req.Flags, allowedFlags)
req.Flags=allowedFlags
 }

accessMode:=req.Flags&unix.O_ACCMODE
trunc:=req.Flags&unix.O_TRUNC!=0
ifc.readonly&& (accessMode!=unix.O_RDONLY||trunc) {
return0, unix.EROFS
 }

fd, err:=c.lookupControlFD(req.FD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
iffd.IsDir() {
// Directory is not truncatable and must be opened with O_RDONLY.
ifaccessMode!=unix.O_RDONLY||trunc {
return0, unix.EISDIR
 }
 }

var (
openFD*OpenFD
hostOpenFDint
 )
iferr:=fd.safelyRead(func() error {
iffd.node.isDeleted() ||fd.IsSymlink() {
returnunix.EINVAL
 }
openFD, hostOpenFD, err=fd.impl.Open(req.Flags)
returnerr
 }); err!=nil {
return0, err
 }

ifhostOpenFD>=0 {
comm.DonateFD(hostOpenFD)
 }
resp:=OpenAtResp{OpenFD: openFD.id}
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// OpenCreateAtHandler handles the OpenCreateAt RPC.
funcOpenCreateAtHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
ifc.readonly {
return0, unix.EROFS
 }
varreqOpenCreateAtReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

// Only keep allowed open flags.
ifallowedFlags:=req.Flags&allowedOpenFlags; allowedFlags!=req.Flags {
log.Debugf("discarding open flags that are not allowed: old open flags = %d, new open flags = %d", req.Flags, allowedFlags)
req.Flags=allowedFlags
 }

name:=string(req.Name)
iferr:=checkSafeName(name); err!=nil {
return0, err
 }

fd, err:=c.lookupControlFD(req.DirFD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
if!fd.IsDir() {
return0, unix.ENOTDIR
 }

var (
childFD*ControlFD
childStat linux.Statx
openFD*OpenFD
hostOpenFDint
 )
iferr:=fd.safelyWrite(func() error {
iffd.node.isDeleted() {
returnunix.EINVAL
 }
childFD, childStat, openFD, hostOpenFD, err=fd.impl.OpenCreate(req.Mode, req.UID, req.GID, name, uint32(req.Flags))
returnerr
 }); err!=nil {
return0, err
 }

ifhostOpenFD>=0 {
comm.DonateFD(hostOpenFD)
 }
resp:=OpenCreateAtResp{
NewFD: openFD.id,
Child: Inode{
ControlFD: childFD.id,
Stat: childStat,
 },
 }
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// CloseHandler handles the Close RPC.
funcCloseHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
varreqCloseReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }
for_, fd:=rangereq.FDs {
c.removeFD(fd)
 }

// There is no response message for this.
return0, nil
}

// FSyncHandler handles the FSync RPC.
funcFSyncHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
varreqFsyncReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

// Return the first error we encounter, but sync everything we can
// regardless.
varretErrerror
for_, fdid:=rangereq.FDs {
iferr:=c.fsyncFD(fdid); err!=nil&&retErr==nil {
retErr=err
 }
 }

// There is no response message for this.
return0, retErr
}

func (c*Connection) fsyncFD(idFDID) error {
fd, err:=c.lookupOpenFD(id)
iferr!=nil {
returnerr
 }
deferfd.DecRef(nil)
returnfd.controlFD.safelyRead(func() error {
returnfd.impl.Sync()
 })
}

// PWriteHandler handles the PWrite RPC.
funcPWriteHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
ifc.readonly {
return0, unix.EROFS
 }
varreqPWriteReq
// Note that it is an optimized Unmarshal operation which avoids any buffer
// allocation and copying. req.Buf just points to payload. This is safe to do
// as the handler owns payload and req's lifetime is limited to the handler.
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

fd, err:=c.lookupOpenFD(req.FD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
if!fd.writable {
return0, unix.EBADF
 }
varcountuint64
iferr:=fd.controlFD.safelyWrite(func() error {
count, err=fd.impl.Write(req.Buf, uint64(req.Offset))
returnerr
 }); err!=nil {
return0, err
 }
resp:=PWriteResp{Count: count}
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// PReadHandler handles the PRead RPC.
funcPReadHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
varreqPReadReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

fd, err:=c.lookupOpenFD(req.FD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
if!fd.readable {
return0, unix.EBADF
 }

// To save an allocation and a copy, we directly read into the payload
// buffer. The rest of the response message is manually marshalled.
varrespPReadResp
respMetaSize:=uint32(resp.NumBytes.SizeBytes())
respPayloadLen:=respMetaSize+req.Count
ifrespPayloadLen>c.maxMessageSize {
return0, unix.ENOBUFS
 }
payloadBuf:=comm.PayloadBuf(respPayloadLen)
varnuint64
iferr:=fd.controlFD.safelyRead(func() error {
n, err=fd.impl.Read(payloadBuf[respMetaSize:], req.Offset)
returnerr
 }); err!=nil {
return0, err
 }

// Write the response metadata onto the payload buffer. The response contents
// already have been written immediately after it.
resp.NumBytes=primitive.Uint64(n)
resp.NumBytes.MarshalUnsafe(payloadBuf)
returnrespMetaSize+uint32(n), nil
}

// MkdirAtHandler handles the MkdirAt RPC.
funcMkdirAtHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
ifc.readonly {
return0, unix.EROFS
 }
varreqMkdirAtReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

name:=string(req.Name)
iferr:=checkSafeName(name); err!=nil {
return0, err
 }

fd, err:=c.lookupControlFD(req.DirFD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
if!fd.IsDir() {
return0, unix.ENOTDIR
 }
var (
childDir*ControlFD
childDirStat linux.Statx
 )
iferr:=fd.safelyWrite(func() error {
iffd.node.isDeleted() {
returnunix.EINVAL
 }
childDir, childDirStat, err=fd.impl.Mkdir(req.Mode, req.UID, req.GID, name)
returnerr
 }); err!=nil {
return0, err
 }

resp:=MkdirAtResp{
ChildDir: Inode{
ControlFD: childDir.id,
Stat: childDirStat,
 },
 }
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// MknodAtHandler handles the MknodAt RPC.
funcMknodAtHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
ifc.readonly {
return0, unix.EROFS
 }
varreqMknodAtReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

name:=string(req.Name)
iferr:=checkSafeName(name); err!=nil {
return0, err
 }

fd, err:=c.lookupControlFD(req.DirFD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
if!fd.IsDir() {
return0, unix.ENOTDIR
 }
var (
child*ControlFD
childStat linux.Statx
 )
iferr:=fd.safelyWrite(func() error {
iffd.node.isDeleted() {
returnunix.EINVAL
 }
child, childStat, err=fd.impl.Mknod(req.Mode, req.UID, req.GID, name, uint32(req.Minor), uint32(req.Major))
returnerr
 }); err!=nil {
return0, err
 }
resp:=MknodAtResp{
Child: Inode{
ControlFD: child.id,
Stat: childStat,
 },
 }
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// SymlinkAtHandler handles the SymlinkAt RPC.
funcSymlinkAtHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
ifc.readonly {
return0, unix.EROFS
 }
varreqSymlinkAtReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

name:=string(req.Name)
iferr:=checkSafeName(name); err!=nil {
return0, err
 }

fd, err:=c.lookupControlFD(req.DirFD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
if!fd.IsDir() {
return0, unix.ENOTDIR
 }
var (
symlink*ControlFD
symlinkStat linux.Statx
 )
iferr:=fd.safelyWrite(func() error {
iffd.node.isDeleted() {
returnunix.EINVAL
 }
symlink, symlinkStat, err=fd.impl.Symlink(name, string(req.Target), req.UID, req.GID)
returnerr
 }); err!=nil {
return0, err
 }
resp:=SymlinkAtResp{
Symlink: Inode{
ControlFD: symlink.id,
Stat: symlinkStat,
 },
 }
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// LinkAtHandler handles the LinkAt RPC.
funcLinkAtHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
ifc.readonly {
return0, unix.EROFS
 }
varreqLinkAtReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

name:=string(req.Name)
iferr:=checkSafeName(name); err!=nil {
return0, err
 }

fd, err:=c.lookupControlFD(req.DirFD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
if!fd.IsDir() {
return0, unix.ENOTDIR
 }

targetFD, err:=c.lookupControlFD(req.Target)
iferr!=nil {
return0, err
 }
defertargetFD.DecRef(nil)
iftargetFD.IsDir() {
// Can not create hard link to directory.
return0, unix.EPERM
 }
var (
link*ControlFD
linkStat linux.Statx
 )
iferr:=fd.safelyWrite(func() error {
iffd.node.isDeleted() {
returnunix.EINVAL
 }
// This is a lock ordering issue. Need to provide safe read guarantee for
// targetFD. We know targetFD is not a directory while fd is a directory.
// So targetFD would either be a descendant of fd or exist elsewhere in the
// tree. So locking fd first and targetFD later should not lead to cycles.
targetFD.node.opMu.RLock()
defertargetFD.node.opMu.RUnlock()
iftargetFD.node.isDeleted() {
returnunix.EINVAL
 }
link, linkStat, err=targetFD.impl.Link(fd.impl, name)
returnerr
 }); err!=nil {
return0, err
 }
resp:=LinkAtResp{
Link: Inode{
ControlFD: link.id,
Stat: linkStat,
 },
 }
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// FStatFSHandler handles the FStatFS RPC.
funcFStatFSHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
varreqFStatFSReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

fd, err:=c.lookupControlFD(req.FD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
varrespStatFS
iferr:=fd.safelyRead(func() error {
resp, err=fd.impl.StatFS()
returnerr
 }); err!=nil {
return0, err
 }
respLen:=uint32(resp.SizeBytes())
resp.MarshalUnsafe(comm.PayloadBuf(respLen))
returnrespLen, nil
}

// FAllocateHandler handles the FAllocate RPC.
funcFAllocateHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
ifc.readonly {
return0, unix.EROFS
 }
varreqFAllocateReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

fd, err:=c.lookupOpenFD(req.FD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
if!fd.writable {
return0, unix.EBADF
 }

return0, fd.controlFD.safelyWrite(func() error {
iffd.controlFD.node.isDeleted() &&!c.server.opts.AllocateOnDeleted {
returnunix.EINVAL
 }
returnfd.impl.Allocate(req.Mode, req.Offset, req.Length)
 })
}

// ReadLinkAtHandler handles the ReadLinkAt RPC.
funcReadLinkAtHandler(c*Connection, commCommunicator, payloadLenuint32) (uint32, error) {
varreqReadLinkAtReq
if_, ok:=req.CheckedUnmarshal(comm.PayloadBuf(payloadLen)); !ok {
return0, unix.EIO
 }

fd, err:=c.lookupControlFD(req.FD)
iferr!=nil {
return0, err
 }
deferfd.DecRef(nil)
if!fd.IsSymlink() {
return0, unix.EINVAL
 }