mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
fuse: Fix use-after-free in fuse_dev_do_write()
After we found req in request_find() and released the lock,
everything may happen with the req in parallel:
cpu0 cpu1
fuse_dev_do_write() fuse_dev_do_write()
req = request_find(fpq, ...) ...
spin_unlock(&fpq->lock) ...
... req = request_find(fpq, oh.unique)
... spin_unlock(&fpq->lock)
queue_interrupt(&fc->iq, req); ...
... ...
... ...
request_end(fc, req);
fuse_put_request(fc, req);
... queue_interrupt(&fc->iq, req);
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 46c34a348b
("fuse: no fc->lock for pqueue parts")
Cc: <stable@vger.kernel.org> # v4.2
This commit is contained in:
parent
bc78abbd55
commit
d2d2d4fb1f
1 changed files with 5 additions and 1 deletions
|
@ -1877,16 +1877,20 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
|
|||
|
||||
/* Is it an interrupt reply? */
|
||||
if (req->intr_unique == oh.unique) {
|
||||
__fuse_get_request(req);
|
||||
spin_unlock(&fpq->lock);
|
||||
|
||||
err = -EINVAL;
|
||||
if (nbytes != sizeof(struct fuse_out_header))
|
||||
if (nbytes != sizeof(struct fuse_out_header)) {
|
||||
fuse_put_request(fc, req);
|
||||
goto err_finish;
|
||||
}
|
||||
|
||||
if (oh.error == -ENOSYS)
|
||||
fc->no_interrupt = 1;
|
||||
else if (oh.error == -EAGAIN)
|
||||
queue_interrupt(&fc->iq, req);
|
||||
fuse_put_request(fc, req);
|
||||
|
||||
fuse_copy_finish(cs);
|
||||
return nbytes;
|
||||
|
|
Loading…
Reference in a new issue