fuse: fix stack use after return
authorMiklos Szeredi <mszeredi@redhat.com>
Thu, 13 Feb 2020 08:16:07 +0000 (09:16 +0100)
committerMiklos Szeredi <mszeredi@redhat.com>
Thu, 13 Feb 2020 08:16:07 +0000 (09:16 +0100)
commit3e8cb8b2eaeb22f540f1cbc00cbb594047b7ba89
tree216e3c9a7b853b2840a7de88faeb8dd65468de0f
parentbb6d3fb354c5ee8d6bde2d576eb7220ea09862b9
fuse: fix stack use after return

Normal, synchronous requests will have their args allocated on the stack.
After the FR_FINISHED bit is set by receiving the reply from the userspace
fuse server, the originating task may return and reuse the stack frame,
resulting in an Oops if the args structure is dereferenced.

Fix by setting a flag in the request itself upon initializing, indicating
whether it has an asynchronous ->end() callback.

Reported-by: Kyle Sanderson <kyle.leet@gmail.com>
Reported-by: Michael Stapelberg <michael+lkml@stapelberg.ch>
Fixes: 2b319d1f6f92 ("fuse: don't dereference req->args on finished request")
Cc: <stable@vger.kernel.org> # v5.4
Tested-by: Michael Stapelberg <michael+lkml@stapelberg.ch>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
fs/fuse/dev.c
fs/fuse/fuse_i.h