Commit 053fc4f7 authored by Al Viro's avatar Al Viro
Browse files

fuse: fix UAF in rcu pathwalks 



->permission(), ->get_link() and ->inode_get_acl() might dereference
->s_fs_info (and, in case of ->permission(), ->s_fs_info->fc->user_ns
as well) when called from rcu pathwalk.

Freeing ->s_fs_info->fc is rcu-delayed; we need to make freeing ->s_fs_info
and dropping ->user_ns rcu-delayed too.

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent e31f0a57

fs/fuse/cuse.c

+1 −2
Original line number Diff line number Diff line
@@ -474,8 +474,7 @@ static int cuse_send_init(struct cuse_conn *cc) 


static void cuse_fc_release(struct fuse_conn *fc)

{

	struct cuse_conn *cc = fc_to_cc(fc);

	kfree_rcu(cc, fc.rcu);

	kfree(fc_to_cc(fc));

}



/**

fs/fuse/fuse_i.h

+1 −0
Original line number Diff line number Diff line
@@ -888,6 +888,7 @@ struct fuse_mount { 


	/* Entry on fc->mounts */

	struct list_head fc_entry;

	struct rcu_head rcu;

};



static inline struct fuse_mount *get_fuse_mount_super(struct super_block *sb)

fs/fuse/inode.c

+11 −4
Original line number Diff line number Diff line
@@ -930,6 +930,14 @@ void fuse_conn_init(struct fuse_conn *fc, struct fuse_mount *fm, 
}

EXPORT_SYMBOL_GPL(fuse_conn_init);



static void delayed_release(struct rcu_head *p)

{

	struct fuse_conn *fc = container_of(p, struct fuse_conn, rcu);



	put_user_ns(fc->user_ns);

	fc->release(fc);

}



void fuse_conn_put(struct fuse_conn *fc)

{

	if (refcount_dec_and_test(&fc->count)) {
@@ -941,13 +949,12 @@ void fuse_conn_put(struct fuse_conn *fc) 
		if (fiq->ops->release)

			fiq->ops->release(fiq);

		put_pid_ns(fc->pid_ns);

		put_user_ns(fc->user_ns);

		bucket = rcu_dereference_protected(fc->curr_bucket, 1);

		if (bucket) {

			WARN_ON(atomic_read(&bucket->count) != 1);

			kfree(bucket);

		}

		fc->release(fc);

		call_rcu(&fc->rcu, delayed_release);

	}

}

EXPORT_SYMBOL_GPL(fuse_conn_put);
@@ -1366,7 +1373,7 @@ EXPORT_SYMBOL_GPL(fuse_send_init); 
void fuse_free_conn(struct fuse_conn *fc)

{

	WARN_ON(!list_empty(&fc->devices));

	kfree_rcu(fc, rcu);

	kfree(fc);

}

EXPORT_SYMBOL_GPL(fuse_free_conn);
@@ -1902,7 +1909,7 @@ static void fuse_sb_destroy(struct super_block *sb) 
void fuse_mount_destroy(struct fuse_mount *fm)

{

	fuse_conn_put(fm->fc);

	kfree(fm);

	kfree_rcu(fm, rcu);

}

EXPORT_SYMBOL(fuse_mount_destroy);