fuse: do not use iocb after it may have been freed (7cabc61e) · Commits · 戴 / test

There's a race in fuse_direct_IO(), whereby is_sync_kiocb() is called on an iocb that could have been freed if async io has already completed. The fix in this case is simple and obvious: cache the result before starting io. It was discovered by KASan: kernel: ================================================================== kernel: BUG: KASan: use after free in fuse_direct_IO+0xb1a/0xcc0 at addr ffff88036c414390 Signed-off-by:

Robert Doebbelin <robert@quobyte.com> Signed-off-by:

Miklos Szeredi <mszeredi@redhat.com> Fixes: ("fuse: enable asynchronous processing direct IO") Cc: <stable@vger.kernel.org> # 3.10+

fs/fuse/file.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -2843,6 +2843,7 @@ fuse_direct_IO(struct kiocb iocb, struct iov_iter iter, loff_t offset)
		loff_t i_size;
		size_t count = iov_iter_count(iter);
		struct fuse_io_priv *io;
		bool is_sync = is_sync_kiocb(iocb);

		pos = offset;
		inode = file->f_mapping->host;
		@@ -2882,11 +2883,11 @@ fuse_direct_IO(struct kiocb iocb, struct iov_iter iter, loff_t offset)
		* to wait on real async I/O requests, so we must submit this request
		* synchronously.
		*/
		if (!is_sync_kiocb(iocb) && (offset + count > i_size) &&
		if (!is_sync && (offset + count > i_size) &&
		iov_iter_rw(iter) == WRITE)
		io->async = false;

		if (io->async && is_sync_kiocb(iocb))
		if (io->async && is_sync)
		io->done = &wait;

		if (iov_iter_rw(iter) == WRITE) {
		@@ -2900,7 +2901,7 @@ fuse_direct_IO(struct kiocb iocb, struct iov_iter iter, loff_t offset)
		fuse_aio_complete(io, ret < 0 ? ret : 0, -1);

		/* we have a non-extending, async request, so return */
		if (!is_sync_kiocb(iocb))
		if (!is_sync)
		return -EIOCBQUEUED;

		wait_for_completion(&wait);

Admin message