]> www.infradead.org Git - users/jedix/linux-maple.git/commit
fuse: do not use iocb after it may have been freed
authorRobert Doebbelin <robert@quobyte.com>
Mon, 7 Mar 2016 08:50:56 +0000 (09:50 +0100)
committerChuck Anderson <chuck.anderson@oracle.com>
Thu, 26 May 2016 22:46:26 +0000 (15:46 -0700)
commit88bdf1a2c491297a5960ea1b2dc6cdf4e04afe74
tree0faa5aa374c4ddb708684afd239bbefec4f70b2a
parentdb539ca087855e2c83a2b7bffe4a141089d19495
fuse: do not use iocb after it may have been freed

Orabug: 23331110

[ Upstream commit 7cabc61e01a0a8b663bd2b4c982aa53048218734 ]

There's a race in fuse_direct_IO(), whereby is_sync_kiocb() is called on an
iocb that could have been freed if async io has already completed.  The fix
in this case is simple and obvious: cache the result before starting io.

It was discovered by KASan:

kernel: ==================================================================
kernel: BUG: KASan: use after free in fuse_direct_IO+0xb1a/0xcc0 at addr ffff88036c414390

Signed-off-by: Robert Doebbelin <robert@quobyte.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: bcba24ccdc82 ("fuse: enable asynchronous processing direct IO")
Cc: <stable@vger.kernel.org> # 3.10+
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
(cherry picked from commit 19167d65fabb60ff11fc5f9c4a5248c17a12f615)

Signed-off-by: Dan Duval <dan.duval@oracle.com>
fs/fuse/file.c