linux

iv/linux

History

Miklos Szeredi e1e71c1688 fuse: fix use after free in fuse_read_interrupt()

There is a potential race between fuse_read_interrupt() and
fuse_request_end().

TASK1
  in fuse_read_interrupt(): delete req->intr_entry (while holding
  fiq->lock)

TASK2
  in fuse_request_end(): req->intr_entry is empty -> skip fiq->lock
  wake up TASK3

TASK3
  request is freed

TASK1
  in fuse_read_interrupt(): dereference req->in.h.unique ***BAM***


Fix by always grabbing fiq->lock if the request was ever interrupted
(FR_INTERRUPTED set) thereby serializing with concurrent
fuse_read_interrupt() calls.

FR_INTERRUPTED is set before the request is queued on fiq->interrupts.
Dequeing the request is done with list_del_init() but FR_INTERRUPTED is not
cleared in this case.

Reported-by: lijiazi <lijiazi@xiaomi.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

2021-08-04 13:22:58 +02:00

acl.c

fuse: add a flag FUSE_SETXATTR_ACL_KILL_SGID to kill SGID

2021-04-14 10:40:57 +02:00

control.c

fuse: split fuse_mount off of fuse_conn

2020-09-18 15:17:41 +02:00

cuse.c

cuse: simplify refcount

2021-04-14 10:40:58 +02:00

dax.c

fuse update for 5.14