Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-02-12 22:18:26 +0100
committerJiri Slaby <jslaby@suse.cz>2019-02-12 22:21:18 +0100
commit22aa8709a7fa4bf7a310cf44e9452169d251fd53 (patch)
tree21ca80c74e786ba1336833cd9eedb743416f26c3
parent856781cdd7c9b456c30f9324da490d55671e5bc6 (diff)
fuse: call pipe_buf_release() under pipe lock (bnc#1012628).
-rw-r--r--patches.kernel.org/4.20.8-311-fuse-call-pipe_buf_release-under-pipe-lock.patch45
-rw-r--r--series.conf1
2 files changed, 46 insertions, 0 deletions
diff --git a/patches.kernel.org/4.20.8-311-fuse-call-pipe_buf_release-under-pipe-lock.patch b/patches.kernel.org/4.20.8-311-fuse-call-pipe_buf_release-under-pipe-lock.patch
new file mode 100644
index 0000000000..1350ecf24b
--- /dev/null
+++ b/patches.kernel.org/4.20.8-311-fuse-call-pipe_buf_release-under-pipe-lock.patch
@@ -0,0 +1,45 @@
+From: Jann Horn <jannh@google.com>
+Date: Sat, 12 Jan 2019 02:39:05 +0100
+Subject: [PATCH] fuse: call pipe_buf_release() under pipe lock
+References: bnc#1012628
+Patch-mainline: 4.20.8
+Git-commit: 9509941e9c534920ccc4771ae70bd6cbbe79df1c
+
+commit 9509941e9c534920ccc4771ae70bd6cbbe79df1c upstream.
+
+Some of the pipe_buf_release() handlers seem to assume that the pipe is
+locked - in particular, anon_pipe_buf_release() accesses pipe->tmp_page
+without taking any extra locks. From a glance through the callers of
+pipe_buf_release(), it looks like FUSE is the only one that calls
+pipe_buf_release() without having the pipe locked.
+
+This bug should only lead to a memory leak, nothing terrible.
+
+Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/fuse/dev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index a5e516a40e7a..ef00a8277824 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -2077,8 +2077,10 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
+
+ ret = fuse_dev_do_write(fud, &cs, len);
+
++ pipe_lock(pipe);
+ for (idx = 0; idx < nbuf; idx++)
+ pipe_buf_release(pipe, &bufs[idx]);
++ pipe_unlock(pipe);
+
+ out:
+ kvfree(bufs);
+--
+2.20.1
+
diff --git a/series.conf b/series.conf
index 0ad0f6ba9f..a44edd7e7c 100644
--- a/series.conf
+++ b/series.conf
@@ -1047,6 +1047,7 @@
patches.kernel.org/4.20.8-308-ALSA-hda-realtek-Fix-lose-hp_pins-for-disable-.patch
patches.kernel.org/4.20.8-309-ALSA-hda-realtek-Use-a-common-helper-for-hp-pi.patch
patches.kernel.org/4.20.8-310-ALSA-hda-realtek-Headset-microphone-support-fo.patch
+ patches.kernel.org/4.20.8-311-fuse-call-pipe_buf_release-under-pipe-lock.patch
########################################################
# Build fixes that apply to the vanilla kernel too.