]> git.baikalelectronics.ru Git - kernel.git/commit
fuse: fix stack use after return
authorMiklos Szeredi <mszeredi@redhat.com>
Thu, 13 Feb 2020 08:16:07 +0000 (09:16 +0100)
committerMiklos Szeredi <mszeredi@redhat.com>
Thu, 13 Feb 2020 08:16:07 +0000 (09:16 +0100)
commit73e624fb17d48dae0f1226316c08fbd48fb64d26
tree216e3c9a7b853b2840a7de88faeb8dd65468de0f
parent9f9285b96014e47599924b03ab0c07fa1549e04b
fuse: fix stack use after return

Normal, synchronous requests will have their args allocated on the stack.
After the FR_FINISHED bit is set by receiving the reply from the userspace
fuse server, the originating task may return and reuse the stack frame,
resulting in an Oops if the args structure is dereferenced.

Fix by setting a flag in the request itself upon initializing, indicating
whether it has an asynchronous ->end() callback.

Reported-by: Kyle Sanderson <kyle.leet@gmail.com>
Reported-by: Michael Stapelberg <michael+lkml@stapelberg.ch>
Fixes: 2c1b1105dd52 ("fuse: don't dereference req->args on finished request")
Cc: <stable@vger.kernel.org> # v5.4
Tested-by: Michael Stapelberg <michael+lkml@stapelberg.ch>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
fs/fuse/dev.c
fs/fuse/fuse_i.h