linux-brain/fs/fuse
Miklos Szeredi 63050b3dc0 fuse: fix stack use after return
commit 3e8cb8b2eaeb22f540f1cbc00cbb594047b7ba89 upstream.

Normal, synchronous requests will have their args allocated on the stack.
After the FR_FINISHED bit is set by receiving the reply from the userspace
fuse server, the originating task may return and reuse the stack frame,
resulting in an Oops if the args structure is dereferenced.

Fix by setting a flag in the request itself upon initializing, indicating
whether it has an asynchronous ->end() callback.

Reported-by: Kyle Sanderson <kyle.leet@gmail.com>
Reported-by: Michael Stapelberg <michael+lkml@stapelberg.ch>
Fixes: 2b319d1f6f ("fuse: don't dereference req->args on finished request")
Cc: <stable@vger.kernel.org> # v5.4
Tested-by: Michael Stapelberg <michael+lkml@stapelberg.ch>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-18 07:17:52 +01:00
..
acl.c fuse: Support fuse filesystems outside of init_user_ns 2018-03-20 17:11:44 +01:00
control.c convenience helper: get_tree_single() 2019-07-04 22:01:58 -04:00
cuse.c fuse: fix memleak in cuse_channel_open 2019-09-24 15:28:01 +02:00
dev.c fuse: fix stack use after return 2020-03-18 07:17:52 +01:00
dir.c fuse: verify attributes 2019-12-13 08:42:31 +01:00
file.c fuse: don't overflow LLONG_MAX with end offset 2020-02-24 08:37:03 +01:00
fuse_i.h fuse: fix stack use after return 2020-03-18 07:17:52 +01:00
inode.c virtio-fs: don't show mount options 2019-10-15 16:11:41 +02:00
Kconfig virtio-fs: add virtiofs filesystem 2019-09-18 20:17:50 +02:00
Makefile virtio-fs: Change module name to virtiofs.ko 2019-10-14 10:20:33 +02:00
readdir.c fuse: verify attributes 2019-12-13 08:42:31 +01:00
virtio_fs.c virtiofs: Remove set but not used variable 'fc' 2019-10-23 10:25:17 +02:00
xattr.c fuse: rearrange and resize fuse_args fields 2019-09-10 16:29:48 +02:00