Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 860448e7 authored by Miklos Szeredi's avatar Miklos Szeredi Committed by Greg Kroah-Hartman
Browse files

fuse: fix page dereference after free 



commit d78092e4937de9ce55edcb4ee4c5e3c707be0190 upstream.

After unlock_request() pages from the ap->pages[] array may be put (e.g. by
aborting the connection) and the pages can be freed.

Prevent use after free by grabbing a reference to the page before calling
unlock_request().

The original patch was created by Pradeep P V K.

Reported-by: default avatarPradeep P V K <ppvk@codeaurora.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4e1a2377

fs/fuse/dev.c

+18 −10
Original line number Diff line number Diff line
@@ -786,15 +786,16 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) 
	struct page *newpage;

	struct pipe_buffer *buf = cs->pipebufs;



	get_page(oldpage);

	err = unlock_request(cs->req);

	if (err)

		return err;

		goto out_put_old;



	fuse_copy_finish(cs);



	err = pipe_buf_confirm(cs->pipe, buf);

	if (err)

		return err;

		goto out_put_old;



	BUG_ON(!cs->nr_segs);

	cs->currbuf = buf;
@@ -834,7 +835,7 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) 
	err = replace_page_cache_page(oldpage, newpage, GFP_KERNEL);

	if (err) {

		unlock_page(newpage);

		return err;

		goto out_put_old;

	}



	get_page(newpage);
@@ -853,14 +854,19 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) 
	if (err) {

		unlock_page(newpage);

		put_page(newpage);

		return err;

		goto out_put_old;

	}



	unlock_page(oldpage);

	/* Drop ref for ap->pages[] array */

	put_page(oldpage);

	cs->len = 0;



	return 0;

	err = 0;

out_put_old:

	/* Drop ref obtained in this function */

	put_page(oldpage);

	return err;



out_fallback_unlock:

	unlock_page(newpage);
@@ -869,10 +875,10 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) 
	cs->offset = buf->offset;



	err = lock_request(cs->req);

	if (err)

		return err;

	if (!err)

		err = 1;



	return 1;

	goto out_put_old;

}



static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page,
@@ -884,14 +890,16 @@ static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page, 
	if (cs->nr_segs == cs->pipe->buffers)

		return -EIO;



	get_page(page);

	err = unlock_request(cs->req);

	if (err)

	if (err) {

		put_page(page);

		return err;

	}



	fuse_copy_finish(cs);



	buf = cs->pipebufs;

	get_page(page);

	buf->page = page;

	buf->offset = offset;

	buf->len = count;