From 901ff4e06d6eabe1fb64a15bf7eec4f1858b9e3b Mon Sep 17 00:00:00 2001
From: Ayush Ranjan <ayushranjan@google.com>
Date: Fri, 18 Feb 2022 22:36:48 -0800
Subject: [PATCH] Make lisafs.FDID a uint64.

Unlike p9 package, lisafs package generates new FDIDs by just atomic
increments of an uint32. It is a one way street to death. We want to make that
street practically infinitely long. This prevents having to track "free" FDIDs
using additional memory like p9 does.

With a uint32, a compromised client can potentially exhaust all 2^32 FDIDs
which will cause the server to panic. Making FDID uint64 makes it reasonably
difficult to do so. Even if we have a good client that creates a new FDID every
1 millisecond, we would hit the limit in 50 days.

It is safe not to make any conservative assumption about the client's rate of
FDID consumption. Given the uint32 would be engrained in lisafs forever, I
think it makes sense to increase it to uint64.

PiperOrigin-RevId: 429713738
---
 pkg/lisafs/fd.go      |  2 +-
 pkg/lisafs/message.go | 15 ++++++++-------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkg/lisafs/fd.go b/pkg/lisafs/fd.go
index b2e254bc0..ce5551ff8 100644
--- a/pkg/lisafs/fd.go
+++ b/pkg/lisafs/fd.go
@@ -26,7 +26,7 @@ import (
 // Each connection has its own FDID namespace.
 //
 // +marshal boundCheck slice:FDIDSlice
-type FDID uint32
+type FDID uint64
 
 // InvalidFDID represents an invalid FDID.
 const InvalidFDID FDID = 0
diff --git a/pkg/lisafs/message.go b/pkg/lisafs/message.go
index a04f84a05..571d378d5 100644
--- a/pkg/lisafs/message.go
+++ b/pkg/lisafs/message.go
@@ -319,7 +319,6 @@ func (s *StringArray) CheckedUnmarshal(src []byte) ([]byte, bool) {
 // +marshal slice:InodeSlice
 type Inode struct {
 	ControlFD FDID
-	_         uint32 // Need to make struct packed.
 	Stat      linux.Statx
 }
 
@@ -434,7 +433,6 @@ func (s *StatReq) String() string {
 // +marshal boundCheck
 type SetStatReq struct {
 	FD    FDID
-	_     uint32
 	Mask  uint32
 	Mode  uint32 // Only permissions part is settable.
 	UID   UID
@@ -630,6 +628,7 @@ func (w *WalkStatResp) CheckedUnmarshal(src []byte) ([]byte, bool) {
 type OpenAtReq struct {
 	FD    FDID
 	Flags uint32
+	_     uint32 // Need to make struct packed.
 }
 
 // String implements fmt.Stringer.String.
@@ -652,10 +651,12 @@ func (o *OpenAtResp) String() string {
 // +marshal
 type createCommon struct {
 	DirFD FDID
-	Mode  linux.FileMode
-	_     uint16 // Need to make struct packed.
 	UID   UID
 	GID   GID
+	Mode  linux.FileMode
+	// The following are needed to make the struct packed.
+	_ uint16
+	_ uint32
 }
 
 // OpenCreateAtReq is used to make OpenCreateAt requests.
@@ -702,7 +703,6 @@ func (o *OpenCreateAtReq) CheckedUnmarshal(src []byte) ([]byte, bool) {
 type OpenCreateAtResp struct {
 	Child Inode
 	NewFD FDID
-	_     uint32 // Need to make struct packed.
 }
 
 // String implements fmt.Stringer.String.
@@ -832,6 +832,7 @@ type PReadReq struct {
 	Offset uint64
 	FD     FDID
 	Count  uint32
+	_      uint32 // Need to make struct packed.
 }
 
 // String implements fmt.Stringer.String.
@@ -1177,7 +1178,6 @@ func (s *StatFS) String() string {
 // +marshal boundCheck
 type FAllocateReq struct {
 	FD     FDID
-	_      uint32
 	Mode   uint64
 	Offset uint64
 	Length uint64
@@ -1262,6 +1262,7 @@ type ConnectReq struct {
 	// case, SockType = 0 means that the socket type does not matter and the
 	// requester will accept any socket type.
 	SockType uint32
+	_        uint32 // Need to make struct packed.
 }
 
 // String implements fmt.Stringer.String.
@@ -1387,6 +1388,7 @@ type Getdents64Req struct {
 	// getdents64(2). Implementations must use the absolute value of Count to
 	// determine the number of bytes to read.
 	Count int32
+	_     uint32 // Need to make struct packed.
 }
 
 // String implements fmt.Stringer.String.
@@ -1659,7 +1661,6 @@ func (*FRemoveXattrResp) String() string {
 // +marshal boundCheck
 type FListXattrReq struct {
 	FD   FDID
-	_    uint32
 	Size uint64
 }