lkml.org 
[lkml]   [2021]   [Sep]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.14 05/32] fuse: fix use after free in fuse_read_interrupt()
    Date
    From: Miklos Szeredi <mszeredi@redhat.com>

    [ Upstream commit e1e71c168813564be0f6ea3d6740a059ca42d177 ]

    There is a potential race between fuse_read_interrupt() and
    fuse_request_end().

    TASK1
    in fuse_read_interrupt(): delete req->intr_entry (while holding
    fiq->lock)

    TASK2
    in fuse_request_end(): req->intr_entry is empty -> skip fiq->lock
    wake up TASK3

    TASK3
    request is freed

    TASK1
    in fuse_read_interrupt(): dereference req->in.h.unique ***BAM***

    Fix by always grabbing fiq->lock if the request was ever interrupted
    (FR_INTERRUPTED set) thereby serializing with concurrent
    fuse_read_interrupt() calls.

    FR_INTERRUPTED is set before the request is queued on fiq->interrupts.
    Dequeing the request is done with list_del_init() but FR_INTERRUPTED is not
    cleared in this case.

    Reported-by: lijiazi <lijiazi@xiaomi.com>
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/fuse/dev.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
    index 1c8f79b3dd06..dde341a6388a 100644
    --- a/fs/fuse/dev.c
    +++ b/fs/fuse/dev.c
    @@ -288,10 +288,10 @@ void fuse_request_end(struct fuse_req *req)

    /*
    * test_and_set_bit() implies smp_mb() between bit
    - * changing and below intr_entry check. Pairs with
    + * changing and below FR_INTERRUPTED check. Pairs with
    * smp_mb() from queue_interrupt().
    */
    - if (!list_empty(&req->intr_entry)) {
    + if (test_bit(FR_INTERRUPTED, &req->flags)) {
    spin_lock(&fiq->lock);
    list_del_init(&req->intr_entry);
    spin_unlock(&fiq->lock);
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-09-11 15:13    [W:5.343 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site