LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Miklos Szeredi <mszeredi@redhat.com>,
	lijiazi <lijiazi@xiaomi.com>, Sasha Levin <sashal@kernel.org>,
	linux-fsdevel@vger.kernel.org
Subject: [PATCH AUTOSEL 5.13 05/29] fuse: fix use after free in fuse_read_interrupt()
Date: Sat, 11 Sep 2021 09:12:09 -0400	[thread overview]
Message-ID: <20210911131233.284800-5-sashal@kernel.org> (raw)
In-Reply-To: <20210911131233.284800-1-sashal@kernel.org>

From: Miklos Szeredi <mszeredi@redhat.com>

[ Upstream commit e1e71c168813564be0f6ea3d6740a059ca42d177 ]

There is a potential race between fuse_read_interrupt() and
fuse_request_end().

TASK1
  in fuse_read_interrupt(): delete req->intr_entry (while holding
  fiq->lock)

TASK2
  in fuse_request_end(): req->intr_entry is empty -> skip fiq->lock
  wake up TASK3

TASK3
  request is freed

TASK1
  in fuse_read_interrupt(): dereference req->in.h.unique ***BAM***

Fix by always grabbing fiq->lock if the request was ever interrupted
(FR_INTERRUPTED set) thereby serializing with concurrent
fuse_read_interrupt() calls.

FR_INTERRUPTED is set before the request is queued on fiq->interrupts.
Dequeing the request is done with list_del_init() but FR_INTERRUPTED is not
cleared in this case.

Reported-by: lijiazi <lijiazi@xiaomi.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fuse/dev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index b8d58aa08206..339ebd3ab4f2 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -288,10 +288,10 @@ void fuse_request_end(struct fuse_req *req)
 
 	/*
 	 * test_and_set_bit() implies smp_mb() between bit
-	 * changing and below intr_entry check. Pairs with
+	 * changing and below FR_INTERRUPTED check. Pairs with
 	 * smp_mb() from queue_interrupt().
 	 */
-	if (!list_empty(&req->intr_entry)) {
+	if (test_bit(FR_INTERRUPTED, &req->flags)) {
 		spin_lock(&fiq->lock);
 		list_del_init(&req->intr_entry);
 		spin_unlock(&fiq->lock);
-- 
2.30.2


  parent reply	other threads:[~2021-09-11 13:14 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-11 13:12 [PATCH AUTOSEL 5.13 01/29] dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 02/29] remoteproc: qcom: wcnss: Fix race with iris probe Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 03/29] mfd: db8500-prcmu: Adjust map to reality Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 04/29] PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms Sasha Levin
2021-09-11 13:12 ` Sasha Levin [this message]
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 06/29] PCI: tegra194: Fix handling BME_CHGED event Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 07/29] PCI: tegra194: Fix MSI-X programming Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 08/29] PCI: tegra: Fix OF node reference leak Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 09/29] mfd: Don't use irq_create_mapping() to resolve a mapping Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 10/29] PCI: rcar: Fix runtime PM imbalance in rcar_pcie_ep_probe() Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 11/29] PCI: rcar: Add L1 link state fix into data abort hook Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 12/29] KVM: arm64: Make hyp_panic() more robust when protected mode is enabled Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 13/29] tracing/probes: Reject events which have the same name of existing one Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 14/29] PCI: cadence: Use bitfield for *quirk_retrain_flag* instead of bool Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 15/29] PCI: cadence: Add quirk flag to set minimum delay in LTSSM Detect.Quiet state Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 16/29] PCI: j721e: Add PCIe support for J7200 Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 17/29] PCI: j721e: Add PCIe support for AM64 Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 18/29] PCI: Add ACS quirks for Cavium multi-function devices Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 19/29] watchdog: Start watchdog in watchdog_set_last_hw_keepalive only if appropriate Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 20/29] octeontx2-af: Add additional register check to rvu_poll_reg() Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 21/29] Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 22/29] flow: fix object-size-mismatch warning in flowi{4,6}_to_flowi_common() Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 23/29] net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 24/29] block, bfq: honor already-setup queue merges Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 25/29] PCI: ibmphp: Fix double unmap of io_mem Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 26/29] ethtool: Fix an error code in cxgb2.c Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 27/29] NTB: Fix an error code in ntb_msit_probe() Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 28/29] NTB: perf: Fix an error code in perf_setup_inbuf() Sasha Levin
2021-09-11 13:12 ` [PATCH AUTOSEL 5.13 29/29] net: phylink: add suspend/resume support Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210911131233.284800-5-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=lijiazi@xiaomi.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mszeredi@redhat.com \
    --cc=stable@vger.kernel.org \
    --subject='Re: [PATCH AUTOSEL 5.13 05/29] fuse: fix use after free in fuse_read_interrupt()' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).