diff options
| author | Joanne Koong <joannelkoong@gmail.com> | 2026-06-23 15:49:37 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-04 13:41:33 +0200 |
| commit | 5927b43a4f8d89e86930f524bf63e9c7e66f61b4 (patch) | |
| tree | 07d3ce19a096cdb9e2f74d8e63047a3897009e80 | |
| parent | 2ec8011cce0cd0fc7a5068585d867fc08d508578 (diff) | |
| download | linux-5927b43a4f8d89e86930f524bf63e9c7e66f61b4.tar.gz linux-5927b43a4f8d89e86930f524bf63e9c7e66f61b4.zip | |
fuse: re-lock request before replacing page cache folio
[ Upstream commit a078484921052d0badd827fcc2770b5cfc1d4120 ]
fuse_try_move_folio() unlocks the request on entry but does not
re-lock it on the success path. This means fuse_chan_abort() can end the
request and free the fuse_io_args (eg fuse_readpages_end()) while the
subsequent copy chain logic after fuse_try_move_folio() accesses the
fuse_io_args, leading to use-after-free issues.
Fix this by calling lock_request() before replace_page_cache_folio().
This ensures the request is locked on the success path which will
prevent the fuse_io_args from being freed while the later copying logic
runs, and also ensures that the ap->folios[i]->mapping is never null
since ap->folios[i] will always point to the newfolio after
replace_page_cache_folio().
Fixes: ce534fb05292 ("fuse: allow splice to move pages")
Cc: stable@vger.kernel.org
Reported-by: Lei Lu <llfamsec@gmail.com>
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/fuse/dev.c | 19 |
1 files changed, 5 insertions, 14 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index abee0cd67182..2d941ee78d9e 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -839,6 +839,10 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) if (WARN_ON(PageMlocked(oldpage))) goto out_fallback_unlock; + err = lock_request(cs->req); + if (err) + goto out_fallback_unlock; + replace_page_cache_page(oldpage, newpage); get_page(newpage); @@ -852,20 +856,7 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) */ pipe_buf_release(cs->pipe, buf); - err = 0; - spin_lock(&cs->req->waitq.lock); - if (test_bit(FR_ABORTED, &cs->req->flags)) - err = -ENOENT; - else - *pagep = newpage; - spin_unlock(&cs->req->waitq.lock); - - if (err) { - unlock_page(newpage); - put_page(newpage); - goto out_put_old; - } - + *pagep = newpage; unlock_page(oldpage); /* Drop ref for ap->pages[] array */ put_page(oldpage); |