Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Robert Doebbelin 9277aac368 fuse: do not use iocb after it may have been freed ... commit 7cabc61e01 upstream. There's a race in fuse_direct_IO(), whereby is_sync_kiocb() is called on an iocb that could have been freed if async io has already completed. The fix in this case is simple and obvious: cache the result before starting io. It was discovered by KASan: kernel: ================================================================== kernel: BUG: KASan: use after free in fuse_direct_IO+0xb1a/0xcc0 at addr ffff88036c414390 Signed-off-by: Robert Doebbelin <robert@quobyte.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Fixes: bcba24ccdc ("fuse: enable asynchronous processing direct IO") [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		History 2016-05-01 00:05:58 +02:00
..
control.c	fuse: add __exit to fuse_ctl_cleanup	2014-04-28 14:19:21 +02:00
cuse.c	fuse: pull iov_iter initializations up	2014-05-06 17:32:51 -04:00
dev.c	fuse: set stolen page uptodate	2015-03-30 11:10:41 +01:00
dir.c	fuse: restructure ->rename2()	2014-07-10 10:50:19 +02:00
file.c	fuse: do not use iocb after it may have been freed	2016-05-01 00:05:58 +02:00
fuse_i.h	fuse: pull iov_iter initializations up	2014-05-06 17:32:51 -04:00
inode.c	sysfs: Create mountpoints with sysfs_create_mount_point	2015-08-20 18:24:03 +01:00
Kconfig	fuse: Move CUSE Kconfig entry from fs/Kconfig into fs/fuse/Kconfig	2013-01-17 13:08:45 +01:00
Makefile	CUSE: implement CUSE - Character device in Userspace	2009-06-09 11:24:11 +02:00