Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58f6eaee authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse 

Pull fuse fixes from Miklos Szeredi:
 "Fix a use after free bug introduced in 4.2 and using an uninitialized
  value introduced in 4.9"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: fix uninitialized flags in pipe_buffer
  fuse: fix use after free issue in fuse_dev_do_read()
parents aa6fba55 84588a93

fs/fuse/dev.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -399,6 +399,10 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) 
static void queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req)

static void queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req)

{

{

	spin_lock(&fiq->waitq.lock);

	spin_lock(&fiq->waitq.lock);

	if (test_bit(FR_FINISHED, &req->flags)) {

		spin_unlock(&fiq->waitq.lock);

		return;

	}

	if (list_empty(&req->intr_entry)) {

	if (list_empty(&req->intr_entry)) {

		list_add_tail(&req->intr_entry, &fiq->interrupts);

		list_add_tail(&req->intr_entry, &fiq->interrupts);

		wake_up_locked(&fiq->waitq);

		wake_up_locked(&fiq->waitq);
@@ -1372,6 +1376,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos, 
		 * code can Oops if the buffer persists after module unload.

		 * code can Oops if the buffer persists after module unload.

		 */

		 */

		bufs[page_nr].ops = &nosteal_pipe_buf_ops;

		bufs[page_nr].ops = &nosteal_pipe_buf_ops;

		bufs[page_nr].flags = 0;

		ret = add_to_pipe(pipe, &bufs[page_nr++]);

		ret = add_to_pipe(pipe, &bufs[page_nr++]);

		if (unlikely(ret < 0))

		if (unlikely(ret < 0))

			break;

			break;