• Robert Doebbelin's avatar
    fuse: do not use iocb after it may have been freed · 7cabc61e
    Robert Doebbelin authored
    There's a race in fuse_direct_IO(), whereby is_sync_kiocb() is called on an
    iocb that could have been freed if async io has already completed.  The fix
    in this case is simple and obvious: cache the result before starting io.
    
    It was discovered by KASan:
    
    kernel: ==================================================================
    kernel: BUG: KASan: use after free in fuse_direct_IO+0xb1a/0xcc0 at addr ffff88036c414390
    Signed-off-by: default avatarRobert Doebbelin <robert@quobyte.com>
    Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
    Fixes: bcba24cc ("fuse: enable asynchronous processing direct IO")
    Cc: <stable@vger.kernel.org> # 3.10+
    7cabc61e
file.c 74.3 KB