linux

iv/linux

History

Miklos Szeredi b7d4f310bb fuse: fix use after free in fuse_read_interrupt()

[ Upstream commit e1e71c168813564be0f6ea3d6740a059ca42d177 ]

There is a potential race between fuse_read_interrupt() and
fuse_request_end().

TASK1
  in fuse_read_interrupt(): delete req->intr_entry (while holding
  fiq->lock)

TASK2
  in fuse_request_end(): req->intr_entry is empty -> skip fiq->lock
  wake up TASK3

TASK3
  request is freed

TASK1
  in fuse_read_interrupt(): dereference req->in.h.unique ***BAM***

Fix by always grabbing fiq->lock if the request was ever interrupted
(FR_INTERRUPTED set) thereby serializing with concurrent
fuse_read_interrupt() calls.

FR_INTERRUPTED is set before the request is queued on fiq->interrupts.
Dequeing the request is done with list_del_init() but FR_INTERRUPTED is not
cleared in this case.

Reported-by: lijiazi <lijiazi@xiaomi.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2021-09-22 12:28:00 +02:00

acl.c

fuse: fix bad inode

2021-01-09 13:46:24 +01:00

control.c

fuse: split fuse_mount off of fuse_conn

2020-09-18 15:17:41 +02:00

cuse.c

cuse: prevent clone

2021-05-19 10:12:56 +02:00

dax.c

fuse: split fuse_mount off of fuse_conn