linux-stable/fs/fuse
Miklos Szeredi 0c4bcfdecb fuse: fix pipe buffer lifetime for direct_io
In FOPEN_DIRECT_IO mode, fuse_file_write_iter() calls
fuse_direct_write_iter(), which normally calls fuse_direct_io(), which then
imports the write buffer with fuse_get_user_pages(), which uses
iov_iter_get_pages() to grab references to userspace pages instead of
actually copying memory.

On the filesystem device side, these pages can then either be read to
userspace (via fuse_dev_read()), or splice()d over into a pipe using
fuse_dev_splice_read() as pipe buffers with &nosteal_pipe_buf_ops.

This is wrong because after fuse_dev_do_read() unlocks the FUSE request,
the userspace filesystem can mark the request as completed, causing write()
to return. At that point, the userspace filesystem should no longer have
access to the pipe buffer.

Fix by copying pages coming from the user address space to new pipe
buffers.

Reported-by: Jann Horn <jannh@google.com>
Fixes: c3021629a0 ("fuse: support splice() reading from fuse device")
Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2022-03-07 16:30:44 +01:00
..
acl.c vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
control.c fuse: name fs_context consistently 2021-08-04 13:22:58 +02:00
cuse.c cuse: simplify refcount 2021-04-14 10:40:58 +02:00
dax.c fuse: mark inode DONT_CACHE when per inode DAX hint changes 2021-12-14 11:09:37 +01:00
dev.c fuse: fix pipe buffer lifetime for direct_io 2022-03-07 16:30:44 +01:00
dir.c fuse: send security context of inode on file 2021-11-25 14:05:18 +01:00
file.c fuse: fix pipe buffer lifetime for direct_io 2022-03-07 16:30:44 +01:00
fuse_i.h fuse: fix pipe buffer lifetime for direct_io 2022-03-07 16:30:44 +01:00
inode.c fuse: move FUSE_SUPER_MAGIC definition to magic.h 2022-02-21 14:57:26 +01:00
ioctl.c fuse: fix fileattr op failure 2022-02-18 11:47:51 +01:00
Kconfig dax: remove CONFIG_DAX_DRIVER 2021-12-04 08:58:51 -08:00
Makefile fuse: move ioctl to separate source file 2021-04-12 15:04:30 +02:00
readdir.c fuse: only update necessary attributes 2021-10-28 09:45:33 +02:00
virtio_fs.c virtio,vdpa,qemu_fw_cfg: features, cleanups, fixes 2022-01-18 10:05:48 +02:00
xattr.c fuse: move fuse_invalidate_attr() into fuse_update_ctime() 2021-10-22 17:03:01 +02:00