lkml.org 
[lkml]   [2018]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] fuse: Fix use-after-free in fuse_dev_do_read()
On Tue, Sep 25, 2018 at 11:28 AM, Kirill Tkhai <ktkhai@virtuozzo.com> wrote:
> We may pick freed req in this way:
>
> [cpu0] [cpu1]
> fuse_dev_do_read() fuse_dev_do_write()
> list_move_tail(&req->list, &fpq->processing); ...
> spin_unlock(&fpq->lock); ...
> ... request_end(fc, req);
> ... fuse_put_request(fc, req);
> if (test_bit(FR_INTERRUPTED, &req->flags))
> queue_interrupt(fiq, req);
>
> Fix that by keeping req alive till we finish all manipulations.
>
> Reported-by: syzbot+4e975615ca01f2277bdd@syzkaller.appspotmail.com
> Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>

Applied.

Thanks,
Miklos

\
 
 \ /
  Last update: 2018-10-01 11:26    [W:3.050 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site