fuse: avoid out-of-scope stack access (6a4e922c) · Commits · 戴 / test

The all pointers within fuse_req must point to valid memory once fuse_force_forget() returns. This bug appeared in "fuse: implement NFS-like readdirplus support" and was never in any official Linux release. I tested the fuse_force_forget() code path by injecting to fake -ENOMEM and verified the FORGET operation was called properly in userspace. Signed-off-by:

Eric Wong <normalperson@yhbt.net> Signed-off-by:

Miklos Szeredi <mszeredi@suse.cz>

fs/fuse/dev.c

+10 −3

Original line number	Diff line number	Diff line
		@@ -440,9 +440,8 @@ __acquires(fc->lock)
		}
		}

		void fuse_request_send(struct fuse_conn fc, struct fuse_req req)
		static void __fuse_request_send(struct fuse_conn fc, struct fuse_req req)
		{
		req->isreply = 1;
		spin_lock(&fc->lock);
		if (!fc->connected)
		req->out.h.error = -ENOTCONN;
		@@ -459,6 +458,12 @@ void fuse_request_send(struct fuse_conn fc, struct fuse_req req)
		}
		spin_unlock(&fc->lock);
		}

		void fuse_request_send(struct fuse_conn fc, struct fuse_req req)
		{
		req->isreply = 1;
		__fuse_request_send(fc, req);
		}
		EXPORT_SYMBOL_GPL(fuse_request_send);

		static void fuse_request_send_nowait_locked(struct fuse_conn *fc,
		@@ -541,7 +546,9 @@ void fuse_force_forget(struct file *file, u64 nodeid)
		req->in.args[0].size = sizeof(inarg);
		req->in.args[0].value = &inarg;
		req->isreply = 0;
		fuse_request_send_nowait(fc, req);
		__fuse_request_send(fc, req);
		/* ignore errors */
		fuse_put_request(fc, req);
		}

		/*

Admin message