Kirill Tkhai bc78abbd55 fuse: Fix use-after-free in fuse_dev_do_read() ... We may pick freed req in this way: [cpu0] [cpu1] fuse_dev_do_read() fuse_dev_do_write() list_move_tail(&req->list, ...); ... spin_unlock(&fpq->lock); ... ... request_end(fc, req); ... fuse_put_request(fc, req); if (test_bit(FR_INTERRUPTED, ...)) queue_interrupt(fiq, req); Fix that by keeping req alive until we finish all manipulations. Reported-by: syzbot+4e975615ca01f2277bdd@syzkaller.appspotmail.com Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Fixes: 46c34a348b ("fuse: no fc->lock for pqueue parts") Cc: <stable@vger.kernel.org> # v4.2		2018-09-28 16:43:21 +02:00
..
acl.c	fuse: Support fuse filesystems outside of init_user_ns	2018-03-20 17:11:44 +01:00
control.c	fuse: fix control dir setup and teardown	2018-05-31 12:26:10 +02:00
cuse.c	fuse: Support fuse filesystems outside of init_user_ns	2018-03-20 17:11:44 +01:00
dev.c	fuse: Fix use-after-free in fuse_dev_do_read()	2018-09-28 16:43:21 +02:00
dir.c	fuse update for 4.19	2018-08-21 18:47:36 -07:00
file.c	fuse update for 4.19	2018-08-21 18:47:36 -07:00
fuse_i.h	fuse: fix initial parallel dirops	2018-07-26 16:13:11 +02:00
inode.c	fuse: convert last timespec use to timespec64	2018-07-26 16:13:12 +02:00
Kconfig	fuse: Add posix ACL support	2016-10-01 07:32:32 +02:00
Makefile	fuse: Use generic xattr ops	2016-10-01 07:32:32 +02:00
xattr.c	fuse: Ensure posix acls are translated outside of init_user_ns	2018-05-31 12:26:10 +02:00