diff options
| author | Eric Wong <normalperson@yhbt.net> | 2013-02-04 13:04:44 +0000 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@suse.cz> | 2013-02-04 15:22:23 +0100 |
| commit | 6a4e922c3db06f7da27e072729e047185c2fba66 (patch) | |
| tree | 26d92e82ab982b25b3f115e52a9bf9956003889b /fs/fuse | |
| parent | 23c153e54197171f30b889d9654929d74b6599d5 (diff) | |
| download | linux-3.10-6a4e922c3db06f7da27e072729e047185c2fba66.tar.gz linux-3.10-6a4e922c3db06f7da27e072729e047185c2fba66.tar.bz2 linux-3.10-6a4e922c3db06f7da27e072729e047185c2fba66.zip | |
fuse: avoid out-of-scope stack access
The all pointers within fuse_req must point to valid memory once
fuse_force_forget() returns.
This bug appeared in "fuse: implement NFS-like readdirplus support"
and was never in any official Linux release.
I tested the fuse_force_forget() code path by injecting to fake -ENOMEM and
verified the FORGET operation was called properly in userspace.
Signed-off-by: Eric Wong <normalperson@yhbt.net>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Diffstat (limited to 'fs/fuse')
| -rw-r--r-- | fs/fuse/dev.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index cbae09e5a49..e9bdec0b16d 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -440,9 +440,8 @@ __acquires(fc->lock) } } -void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req) +static void __fuse_request_send(struct fuse_conn *fc, struct fuse_req *req) { - req->isreply = 1; spin_lock(&fc->lock); if (!fc->connected) req->out.h.error = -ENOTCONN; @@ -459,6 +458,12 @@ void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req) } spin_unlock(&fc->lock); } + +void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req) +{ + req->isreply = 1; + __fuse_request_send(fc, req); +} EXPORT_SYMBOL_GPL(fuse_request_send); static void fuse_request_send_nowait_locked(struct fuse_conn *fc, @@ -541,7 +546,9 @@ void fuse_force_forget(struct file *file, u64 nodeid) req->in.args[0].size = sizeof(inarg); req->in.args[0].value = &inarg; req->isreply = 0; - fuse_request_send_nowait(fc, req); + __fuse_request_send(fc, req); + /* ignore errors */ + fuse_put_request(fc, req); } /* |