Kirill Tkhai 7574afe0cf fuse: Fix use-after-free in fuse_dev_do_read() ... commit bc78abbd55dd28e2287ec6d6502b842321a17c87 upstream. We may pick freed req in this way: [cpu0] [cpu1] fuse_dev_do_read() fuse_dev_do_write() list_move_tail(&req->list, ...); ... spin_unlock(&fpq->lock); ... ... request_end(fc, req); ... fuse_put_request(fc, req); if (test_bit(FR_INTERRUPTED, ...)) queue_interrupt(fiq, req); Fix that by keeping req alive until we finish all manipulations. Reported-by: syzbot+4e975615ca01f2277bdd@syzkaller.appspotmail.com Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Fixes: 46c34a348b ("fuse: no fc->lock for pqueue parts") Cc: <stable@vger.kernel.org> # v4.2 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-11-21 09:27:39 +01:00
..
control.c	fuse: fix control dir setup and teardown	2018-07-03 11:21:28 +02:00
cuse.c	fuse: Add reference counting for fuse_io_priv	2016-04-12 09:08:58 -07:00
dev.c	fuse: Fix use-after-free in fuse_dev_do_read()	2018-11-21 09:27:39 +01:00
dir.c	fuse: atomic_o_trunc should truncate pagecache	2018-07-03 11:21:28 +02:00
file.c	fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio	2018-11-10 07:41:37 -08:00
fuse_i.h	fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio	2018-11-10 07:41:37 -08:00
inode.c	fuse: Fix oops at process_init_reply()	2018-09-05 09:18:39 +02:00
Kconfig	fuse: Move CUSE Kconfig entry from fs/Kconfig into fs/fuse/Kconfig	2013-01-17 13:08:45 +01:00
Makefile	CUSE: implement CUSE - Character device in Userspace	2009-06-09 11:24:11 +02:00