Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a4e922c authored by Eric Wong's avatar Eric Wong Committed by Miklos Szeredi
Browse files

fuse: avoid out-of-scope stack access 



The all pointers within fuse_req must point to valid memory once
fuse_force_forget() returns.

This bug appeared in "fuse: implement NFS-like readdirplus support"
and was never in any official Linux release.

I tested the fuse_force_forget() code path by injecting to fake -ENOMEM and
verified the FORGET operation was called properly in userspace.

Signed-off-by: default avatarEric Wong <normalperson@yhbt.net>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
parent 23c153e5

fs/fuse/dev.c

+10 −3
Original line number Diff line number Diff line
@@ -440,9 +440,8 @@ __acquires(fc->lock) 
	}

}



void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)

static void __fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)

{

	req->isreply = 1;

	spin_lock(&fc->lock);

	if (!fc->connected)

		req->out.h.error = -ENOTCONN;
@@ -459,6 +458,12 @@ void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req) 
	}

	spin_unlock(&fc->lock);

}



void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)

{

	req->isreply = 1;

	__fuse_request_send(fc, req);

}

EXPORT_SYMBOL_GPL(fuse_request_send);



static void fuse_request_send_nowait_locked(struct fuse_conn *fc,
@@ -541,7 +546,9 @@ void fuse_force_forget(struct file *file, u64 nodeid) 
	req->in.args[0].size = sizeof(inarg);

	req->in.args[0].value = &inarg;

	req->isreply = 0;

	fuse_request_send_nowait(fc, req);

	__fuse_request_send(fc, req);

	/* ignore errors */

	fuse_put_request(fc, req);

}



/*