Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
In-Reply-To: <153786771676.20496.9149001582398031266.stgit@localhost.localdomain>
References: <153786771676.20496.9149001582398031266.stgit@localhost.localdomain>
From:   Miklos Szeredi <miklos@szeredi.hu>
Date:   Mon, 1 Oct 2018 11:25:42 +0200
Message-ID: <CAJfpegugvGFMYHCCTewcFe67XwVgRQrXnnucGZg=W+uqnj93=Q@mail.gmail.com>
Subject: Re: [PATCH] fuse: Fix use-after-free in fuse_dev_do_read()
To:     Kirill Tkhai <ktkhai@virtuozzo.com>
Cc:     syzbot <syzbot+4e975615ca01f2277bdd@syzkaller.appspotmail.com>,
        linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Tue, Sep 25, 2018 at 11:28 AM, Kirill Tkhai <ktkhai@virtuozzo.com> wrote:
> We may pick freed req in this way:
>
> [cpu0]                                              [cpu1]
> fuse_dev_do_read()                                  fuse_dev_do_write()
>    list_move_tail(&req->list, &fpq->processing);      ...
>    spin_unlock(&fpq->lock);                           ...
>    ...                                                request_end(fc, req);
>    ...                                                  fuse_put_request(fc, req);
>    if (test_bit(FR_INTERRUPTED, &req->flags))
>          queue_interrupt(fiq, req);
>
> Fix that by keeping req alive till we finish all manipulations.
>
> Reported-by: syzbot+4e975615ca01f2277bdd@syzkaller.appspotmail.com
> Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>

Applied.

Thanks,
Miklos