summaryrefslogtreecommitdiffstats
path: root/fs/fuse/dev.c
diff options
context:
space:
mode:
authorEric Wong <normalperson@yhbt.net>2013-02-04 13:04:44 +0000
committerMiklos Szeredi <mszeredi@suse.cz>2013-02-04 15:22:23 +0100
commit6a4e922c3db06f7da27e072729e047185c2fba66 (patch)
tree26d92e82ab982b25b3f115e52a9bf9956003889b /fs/fuse/dev.c
parent23c153e54197171f30b889d9654929d74b6599d5 (diff)
downloadop-kernel-dev-6a4e922c3db06f7da27e072729e047185c2fba66.zip
op-kernel-dev-6a4e922c3db06f7da27e072729e047185c2fba66.tar.gz
fuse: avoid out-of-scope stack access
The all pointers within fuse_req must point to valid memory once fuse_force_forget() returns. This bug appeared in "fuse: implement NFS-like readdirplus support" and was never in any official Linux release. I tested the fuse_force_forget() code path by injecting to fake -ENOMEM and verified the FORGET operation was called properly in userspace. Signed-off-by: Eric Wong <normalperson@yhbt.net> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Diffstat (limited to 'fs/fuse/dev.c')
-rw-r--r--fs/fuse/dev.c13
1 files changed, 10 insertions, 3 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index cbae09e..e9bdec0 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -440,9 +440,8 @@ __acquires(fc->lock)
}
}
-void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
+static void __fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
{
- req->isreply = 1;
spin_lock(&fc->lock);
if (!fc->connected)
req->out.h.error = -ENOTCONN;
@@ -459,6 +458,12 @@ void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
}
spin_unlock(&fc->lock);
}
+
+void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
+{
+ req->isreply = 1;
+ __fuse_request_send(fc, req);
+}
EXPORT_SYMBOL_GPL(fuse_request_send);
static void fuse_request_send_nowait_locked(struct fuse_conn *fc,
@@ -541,7 +546,9 @@ void fuse_force_forget(struct file *file, u64 nodeid)
req->in.args[0].size = sizeof(inarg);
req->in.args[0].value = &inarg;
req->isreply = 0;
- fuse_request_send_nowait(fc, req);
+ __fuse_request_send(fc, req);
+ /* ignore errors */
+ fuse_put_request(fc, req);
}
/*
OpenPOWER on IntegriCloud