Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7cabc61e authored by Robert Doebbelin's avatar Robert Doebbelin Committed by Miklos Szeredi
Browse files

fuse: do not use iocb after it may have been freed 



There's a race in fuse_direct_IO(), whereby is_sync_kiocb() is called on an
iocb that could have been freed if async io has already completed.  The fix
in this case is simple and obvious: cache the result before starting io.

It was discovered by KASan:

kernel: ==================================================================
kernel: BUG: KASan: use after free in fuse_direct_IO+0xb1a/0xcc0 at addr ffff88036c414390

Signed-off-by: default avatarRobert Doebbelin <robert@quobyte.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
Fixes: bcba24cc ("fuse: enable asynchronous processing direct IO")
Cc: <stable@vger.kernel.org> # 3.10+
parent b562e44f

fs/fuse/file.c

+4 −3
Original line number Diff line number Diff line
@@ -2843,6 +2843,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) 
	loff_t i_size;

	size_t count = iov_iter_count(iter);

	struct fuse_io_priv *io;

	bool is_sync = is_sync_kiocb(iocb);



	pos = offset;

	inode = file->f_mapping->host;
@@ -2882,11 +2883,11 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) 
	 * to wait on real async I/O requests, so we must submit this request

	 * synchronously.

	 */

	if (!is_sync_kiocb(iocb) && (offset + count > i_size) &&

	if (!is_sync && (offset + count > i_size) &&

	    iov_iter_rw(iter) == WRITE)

		io->async = false;



	if (io->async && is_sync_kiocb(iocb))

	if (io->async && is_sync)

		io->done = &wait;



	if (iov_iter_rw(iter) == WRITE) {
@@ -2900,7 +2901,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) 
		fuse_aio_complete(io, ret < 0 ? ret : 0, -1);



		/* we have a non-extending, async request, so return */

		if (!is_sync_kiocb(iocb))

		if (!is_sync)

			return -EIOCBQUEUED;



		wait_for_completion(&wait);