Messages in this thread | | | From | Miklos Szeredi <> | Date | Mon, 1 Oct 2018 11:25:42 +0200 | Subject | Re: [PATCH] fuse: Fix use-after-free in fuse_dev_do_read() |
| |
On Tue, Sep 25, 2018 at 11:28 AM, Kirill Tkhai <ktkhai@virtuozzo.com> wrote: > We may pick freed req in this way: > > [cpu0] [cpu1] > fuse_dev_do_read() fuse_dev_do_write() > list_move_tail(&req->list, &fpq->processing); ... > spin_unlock(&fpq->lock); ... > ... request_end(fc, req); > ... fuse_put_request(fc, req); > if (test_bit(FR_INTERRUPTED, &req->flags)) > queue_interrupt(fiq, req); > > Fix that by keeping req alive till we finish all manipulations. > > Reported-by: syzbot+4e975615ca01f2277bdd@syzkaller.appspotmail.com > Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Applied.
Thanks, Miklos
| |