fuse: fix page stealing
It is possible to trigger a crash by splicing anon pipe bufs to the fuse device. The reason for this is that anon_pipe_buf_release() will reuse buf->page if the refcount is 1, but that page might have already been stolen and its flags modified (e.g. PG_lru added). This happens in the unlikely case of fuse_dev_splice_write() getting around to calling pipe_buf_release() after a page has been stolen, added to the page cache and removed from the page cache. Fix by calling pipe_buf_release() right after the page was inserted into the page cache. In this case the page has an elevated refcount so any release function will know that the page isn't reusable. Reported-by: Frank Dinoff <fdinoff@google.com> Link: https://lore.kernel.org/r/CAAmZXrsGg2xsP1CK+cbuEMumtrqdvD-NKnWzhNcvn71RV3c1yw@mail.gmail.com/ Fixes: dd3bb14f ("fuse: support splice() writing to fuse device") Cc: <stable@vger.kernel.org> # v2.6.35 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
parent
7c594bbd
-
mentioned in commit 65f1f3eb
-
mentioned in commit 22b814fd
-
mentioned in commit 8f4d0719
-
mentioned in commit 54f682cd
-
mentioned in commit 017fc242
-
mentioned in commit 89f4bb06
-
mentioned in commit d0000844
-
mentioned in commit b4b7ea5e
-
mentioned in commit b4f9fe9a
-
mentioned in commit b97f5af5
Please register or sign in to comment