mirror of
https://github.com/torvalds/linux.git
synced 2024-12-05 02:23:16 +00:00
5d069dbe8a
Jan Kara's analysis of the syzbot report (edited): The reproducer opens a directory on FUSE filesystem, it then attaches dnotify mark to the open directory. After that a fuse_do_getattr() call finds that attributes returned by the server are inconsistent, and calls make_bad_inode() which, among other things does: inode->i_mode = S_IFREG; This then confuses dnotify which doesn't tear down its structures properly and eventually crashes. Avoid calling make_bad_inode() on a live inode: switch to a private flag on the fuse inode. Also add the test to ops which the bad_inode_ops would have caught. This bug goes back to the initial merge of fuse in 2.6.14... Reported-by: syzbot+f427adf9324b92652ccc@syzkaller.appspotmail.com Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Tested-by: Jan Kara <jack@suse.cz> Cc: <stable@vger.kernel.org> |
||
---|---|---|
.. | ||
acl.c | ||
control.c | ||
cuse.c | ||
dax.c | ||
dev.c | ||
dir.c | ||
file.c | ||
fuse_i.h | ||
inode.c | ||
Kconfig | ||
Makefile | ||
readdir.c | ||
virtio_fs.c | ||
xattr.c |