Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9b5f361a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'fuse-fixes-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse 

Pull fuse fixes from Miklos Szeredi:
 "A couple of fixes, all bound for -stable (i.e. not regressions in this
  cycle)"

* tag 'fuse-fixes-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: fix use-after-free in fuse_direct_IO()
  fuse: fix possibly missed wake-up after abort
  fuse: fix leaked notify reply
parents da5322e6 ebacb812

fs/fuse/dev.c

+12 −4
Original line number Diff line number Diff line
@@ -165,9 +165,13 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background) 


static void fuse_drop_waiting(struct fuse_conn *fc)

{

	if (fc->connected) {

		atomic_dec(&fc->num_waiting);

	} else if (atomic_dec_and_test(&fc->num_waiting)) {

	/*

	 * lockess check of fc->connected is okay, because atomic_dec_and_test()

	 * provides a memory barrier mached with the one in fuse_wait_aborted()

	 * to ensure no wake-up is missed.

	 */

	if (atomic_dec_and_test(&fc->num_waiting) &&

	    !READ_ONCE(fc->connected)) {

		/* wake up aborters */

		wake_up_all(&fc->blocked_waitq);

	}
@@ -1768,8 +1772,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, 
	req->in.args[1].size = total_len;



	err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);

	if (err)

	if (err) {

		fuse_retrieve_end(fc, req);

		fuse_put_request(fc, req);

	}



	return err;

}
@@ -2219,6 +2225,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn); 


void fuse_wait_aborted(struct fuse_conn *fc)

{

	/* matches implicit memory barrier in fuse_drop_waiting() */

	smp_mb();

	wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);

}

fs/fuse/file.c

+3 −1
Original line number Diff line number Diff line
@@ -2924,10 +2924,12 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter) 
	}



	if (io->async) {

		bool blocking = io->blocking;



		fuse_aio_complete(io, ret < 0 ? ret : 0, -1);



		/* we have a non-extending, async request, so return */

		if (!io->blocking)

		if (!blocking)

			return -EIOCBQUEUED;



		wait_for_completion(&wait);