Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1585320
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 03/15] fuse: fix use after free issue in fuse_dev_do_read() |
| Date | 2017-02-21 14:20 +0100 |
| Message-ID | <tdiwi-340-7@gated-at.bofh.it> (permalink) |
| References | <tdimB-30G-11@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sahitya Tummala <stummala@codeaurora.org>
commit 6ba4d2722d06960102c981322035239cd66f7316 upstream.
There is a potential race between fuse_dev_do_write()
and request_wait_answer() contexts as shown below:
TASK 1:
__fuse_request_send():
|--spin_lock(&fiq->waitq.lock);
|--queue_request();
|--spin_unlock(&fiq->waitq.lock);
|--request_wait_answer():
|--if (test_bit(FR_SENT, &req->flags))
<gets pre-empted after it is validated true>
TASK 2:
fuse_dev_do_write():
|--clears bit FR_SENT,
|--request_end():
|--sets bit FR_FINISHED
|--spin_lock(&fiq->waitq.lock);
|--list_del_init(&req->intr_entry);
|--spin_unlock(&fiq->waitq.lock);
|--fuse_put_request();
|--queue_interrupt();
<request gets queued to interrupts list>
|--wake_up_locked(&fiq->waitq);
|--wait_event_freezable();
<as FR_FINISHED is set, it returns and then
the caller frees this request>
Now, the next fuse_dev_do_read(), see interrupts list is not empty
and then calls fuse_read_interrupt() which tries to access the request
which is already free'd and gets the below crash:
[11432.401266] Unable to handle kernel paging request at virtual address
6b6b6b6b6b6b6b6b
...
[11432.418518] Kernel BUG at ffffff80083720e0
[11432.456168] PC is at __list_del_entry+0x6c/0xc4
[11432.463573] LR is at fuse_dev_do_read+0x1ac/0x474
...
[11432.679999] [<ffffff80083720e0>] __list_del_entry+0x6c/0xc4
[11432.687794] [<ffffff80082c65e0>] fuse_dev_do_read+0x1ac/0x474
[11432.693180] [<ffffff80082c6b14>] fuse_dev_read+0x6c/0x78
[11432.699082] [<ffffff80081d5638>] __vfs_read+0xc0/0xe8
[11432.704459] [<ffffff80081d5efc>] vfs_read+0x90/0x108
[11432.709406] [<ffffff80081d67f0>] SyS_read+0x58/0x94
As FR_FINISHED bit is set before deleting the intr_entry with input
queue lock in request completion path, do the testing of this flag and
queueing atomically with the same lock in queue_interrupt().
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: fd22d62ed0c3 ("fuse: no fc->lock for iqueue parts")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/dev.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -418,6 +418,10 @@ static void request_end(struct fuse_conn
static void queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req)
{
spin_lock(&fiq->waitq.lock);
+ if (test_bit(FR_FINISHED, &req->flags)) {
+ spin_unlock(&fiq->waitq.lock);
+ return;
+ }
if (list_empty(&req->intr_entry)) {
list_add_tail(&req->intr_entry, &fiq->interrupts);
wake_up_locked(&fiq->waitq);
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 00/15] 4.4.51-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:10 +0100
[PATCH 4.4 11/15] printk: use rcuidle console tracepoint Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:10 +0100
[PATCH 4.4 09/15] futex: Move futex_init() to core_initcall Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:10 +0100
[PATCH 4.4 06/15] Input: elan_i2c - add ELAN0605 to the ACPI table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:10 +0100
[PATCH 4.4 12/15] NTB: ntb_transport: fix debugfs_remove_recursive Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:10 +0100
[PATCH 4.4 10/15] ARM: 8658/1: uaccess: fix zeroing of 64-bit get_user() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:10 +0100
[PATCH 4.4 02/15] [media] siano: make it work again with CONFIG_VMAP_STACK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:20 +0100
Re: [PATCH 4.4 02/15] [media] siano: make it work again with CONFIG_VMAP_STACK Mauro Carvalho Chehab <mchehab@s-opensource.com> - 2017-02-22 22:40 +0100
Re: [PATCH 4.4 02/15] [media] siano: make it work again with CONFIG_VMAP_STACK Eddie Chapman <eddie@ehuk.net> - 2017-02-22 22:50 +0100
[PATCH 4.4 05/15] Fix missing sanity check in /dev/sg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:20 +0100
[PATCH 4.4 04/15] scsi: dont BUG_ON() empty DMA transfers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:20 +0100
[PATCH 4.4 03/15] fuse: fix use after free issue in fuse_dev_do_read() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:20 +0100
[PATCH 4.4 14/15] bcache: Make gc wakeup sane, remove set_task_state() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:20 +0100
[PATCH 4.4 15/15] mmc: core: fix multi-bit bus width without high-speed mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:20 +0100
[PATCH 4.4 13/15] ntb_transport: Pick an unused queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:20 +0100
[PATCH 4.4 08/15] drm/dp/mst: fix kernel oops when turning off secondary monitor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-21 14:20 +0100
Re: [PATCH 4.4 00/15] 4.4.51-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-21 17:20 +0100
Re: [PATCH 4.4 00/15] 4.4.51-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-22 00:50 +0100
csiph-web