Overlay runsc regular file mounts with regular files.

Fixes #4991

PiperOrigin-RevId: 345800333

3 files changed, 84 insertions, 35 deletions

diff --git a/pkg/sentry/fsimpl/overlay/copy_up.go b/pkg/sentry/fsimpl/overlay/copy_up.go
index 469f3a33d..27b00cf6f 100644
--- a/pkg/sentry/fsimpl/overlay/copy_up.go
+++ b/pkg/sentry/fsimpl/overlay/copy_up.go
@@ -16,7 +16,6 @@ package overlay
 
 import (
 	"fmt"
-	"io"
 	"sync/atomic"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
@@ -129,25 +128,9 @@ func (d *dentry) copyUpLocked(ctx context.Context) error {
 			return err
 		}
 		defer newFD.DecRef(ctx)
-		bufIOSeq := usermem.BytesIOSequence(make([]byte, 32*1024)) // arbitrary buffer size
-		for {
-			readN, readErr := oldFD.Read(ctx, bufIOSeq, vfs.ReadOptions{})
-			if readErr != nil && readErr != io.EOF {
-				cleanupUndoCopyUp()
-				return readErr
-			}
-			total := int64(0)
-			for total < readN {
-				writeN, writeErr := newFD.Write(ctx, bufIOSeq.DropFirst64(total), vfs.WriteOptions{})
-				total += writeN
-				if writeErr != nil {
-					cleanupUndoCopyUp()
-					return writeErr
-				}
-			}
-			if readErr == io.EOF {
-				break
-			}
+		if _, err := vfs.CopyRegularFileData(ctx, newFD, oldFD); err != nil {
+			cleanupUndoCopyUp()
+			return err
 		}
 		d.mapsMu.Lock()
 		defer d.mapsMu.Unlock()
diff --git a/pkg/sentry/vfs/file_description.go b/pkg/sentry/vfs/file_description.go
index 2153382e9..5321ac80a 100644
--- a/pkg/sentry/vfs/file_description.go
+++ b/pkg/sentry/vfs/file_description.go
@@ -15,6 +15,7 @@
 package vfs
 
 import (
+	"io"
 	"sync/atomic"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
@@ -838,3 +839,28 @@ func (fd *FileDescription) SetAsyncHandler(newHandler func() FileAsync) FileAsyn
 	}
 	return fd.asyncHandler
 }
+
+// CopyRegularFileData copies data from srcFD to dstFD until reading from srcFD
+// returns EOF or an error. It returns the number of bytes copied.
+func CopyRegularFileData(ctx context.Context, dstFD, srcFD *FileDescription) (int64, error) {
+	done := int64(0)
+	buf := usermem.BytesIOSequence(make([]byte, 32*1024)) // arbitrary buffer size
+	for {
+		readN, readErr := srcFD.Read(ctx, buf, ReadOptions{})
+		if readErr != nil && readErr != io.EOF {
+			return done, readErr
+		}
+		src := buf.TakeFirst64(readN)
+		for src.NumBytes() != 0 {
+			writeN, writeErr := dstFD.Write(ctx, src, WriteOptions{})
+			done += writeN
+			src = src.DropFirst64(writeN)
+			if writeErr != nil {
+				return done, writeErr
+			}
+		}
+		if readErr == io.EOF {
+			return done, nil
+		}
+	}
+}
diff --git a/runsc/boot/vfs.go b/runsc/boot/vfs.go
index b157387ef..3fd28e516 100644
--- a/runsc/boot/vfs.go
+++ b/runsc/boot/vfs.go
@@ -250,36 +250,76 @@ func (c *containerMounter) configureOverlay(ctx context.Context, creds *auth.Cre
 	overlayOpts := *lowerOpts
 	overlayOpts.GetFilesystemOptions = vfs.GetFilesystemOptions{}
 
-	// Next mount upper and lower. Upper is a tmpfs mount to keep all
-	// modifications inside the sandbox.
-	upper, err := c.k.VFS().MountDisconnected(ctx, creds, "" /* source */, tmpfs.Name, &upperOpts)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to create upper layer for overlay, opts: %+v: %v", upperOpts, err)
-	}
-	cu := cleanup.Make(func() { upper.DecRef(ctx) })
-	defer cu.Clean()
-
 	// All writes go to the upper layer, be paranoid and make lower readonly.
 	lowerOpts.ReadOnly = true
 	lower, err := c.k.VFS().MountDisconnected(ctx, creds, "" /* source */, lowerFSName, lowerOpts)
 	if err != nil {
 		return nil, nil, err
 	}
-	cu.Add(func() { lower.DecRef(ctx) })
+	cu := cleanup.Make(func() { lower.DecRef(ctx) })
+	defer cu.Clean()
 
-	// Propagate the lower layer's root's owner, group, and mode to the upper
-	// layer's root for consistency with VFS1.
-	upperRootVD := vfs.MakeVirtualDentry(upper, upper.Root())
+	// Determine the lower layer's root's type.
 	lowerRootVD := vfs.MakeVirtualDentry(lower, lower.Root())
 	stat, err := c.k.VFS().StatAt(ctx, creds, &vfs.PathOperation{
 		Root:  lowerRootVD,
 		Start: lowerRootVD,
 	}, &vfs.StatOptions{
-		Mask: linux.STATX_UID | linux.STATX_GID | linux.STATX_MODE,
+		Mask: linux.STATX_UID | linux.STATX_GID | linux.STATX_MODE | linux.STATX_TYPE,
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, fmt.Errorf("failed to stat lower layer's root: %v", err)
+	}
+	if stat.Mask&linux.STATX_TYPE == 0 {
+		return nil, nil, fmt.Errorf("failed to get file type of lower layer's root")
+	}
+	rootType := stat.Mode & linux.S_IFMT
+	if rootType != linux.S_IFDIR && rootType != linux.S_IFREG {
+		return nil, nil, fmt.Errorf("lower layer's root has unsupported file type %v", rootType)
+	}
+
+	// Upper is a tmpfs mount to keep all modifications inside the sandbox.
+	upperOpts.GetFilesystemOptions.InternalData = tmpfs.FilesystemOpts{
+		RootFileType: uint16(rootType),
+	}
+	upper, err := c.k.VFS().MountDisconnected(ctx, creds, "" /* source */, tmpfs.Name, &upperOpts)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create upper layer for overlay, opts: %+v: %v", upperOpts, err)
+	}
+	cu.Add(func() { upper.DecRef(ctx) })
+
+	// If the overlay mount consists of a regular file, copy up its contents
+	// from the lower layer, since in the overlay the otherwise-empty upper
+	// layer file will take precedence.
+	upperRootVD := vfs.MakeVirtualDentry(upper, upper.Root())
+	if rootType == linux.S_IFREG {
+		lowerFD, err := c.k.VFS().OpenAt(ctx, creds, &vfs.PathOperation{
+			Root:  lowerRootVD,
+			Start: lowerRootVD,
+		}, &vfs.OpenOptions{
+			Flags: linux.O_RDONLY,
+		})
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to open lower layer root for copying: %v", err)
+		}
+		defer lowerFD.DecRef(ctx)
+		upperFD, err := c.k.VFS().OpenAt(ctx, creds, &vfs.PathOperation{
+			Root:  upperRootVD,
+			Start: upperRootVD,
+		}, &vfs.OpenOptions{
+			Flags: linux.O_WRONLY,
+		})
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to open upper layer root for copying: %v", err)
+		}
+		defer upperFD.DecRef(ctx)
+		if _, err := vfs.CopyRegularFileData(ctx, upperFD, lowerFD); err != nil {
+			return nil, nil, fmt.Errorf("failed to copy up overlay file: %v", err)
+		}
 	}
+
+	// Propagate the lower layer's root's owner, group, and mode to the upper
+	// layer's root for consistency with VFS1.
 	err = c.k.VFS().SetStatAt(ctx, creds, &vfs.PathOperation{
 		Root:  upperRootVD,
 		Start: upperRootVD,