Miklos Szeredi
ac8fa186fc
UPSTREAM: fuse: fix readdir cache race
...
[ Upstream commit 9fa248c65bdbf5af0a2f74dd38575acfc8dfd2bf ]
There's a race in fuse's readdir cache that can result in an uninitilized
page being read. The page lock is supposed to prevent this from happening
but in the following case it doesn't:
Two fuse_add_dirent_to_cache() start out and get the same parameters
(size=0,offset=0). One of them wins the race to create and lock the page,
after which it fills in data, sets rdc.size and unlocks the page.
In the meantime the page gets evicted from the cache before the other
instance gets to run. That one also creates the page, but finds the
size to be mismatched, bails out and leaves the uninitialized page in the
cache.
Fix by marking a filled page uptodate and ignoring non-uptodate pages.
Reported-by: Frank Sorenson <fsorenso@redhat.com>
Fixes: 5d7bc7e868 ("fuse: allow using readdir cache")
Cc: <stable@vger.kernel.org> # v4.20
Change-Id: I1dea0531dd4d2cb0b89b8e1ee6796339fc2dc624
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2026-05-08 21:46:18 +02:00
..
9p
UPSTREAM: new helper: inode_wrong_type()
2026-05-08 21:46:14 +02:00
adfs
affs
affs: don't write overlarge OFS data block size fields
2025-04-10 14:29:42 +02:00
afs
BACKPORT: bdi: initialize ->ra_pages and ->io_pages in bdi_init
2026-05-08 21:46:13 +02:00
autofs
befs
bfs
btrfs
BACKPORT: bdi: initialize ->ra_pages and ->io_pages in bdi_init
2026-05-08 21:46:13 +02:00
cachefiles
cachefiles: fix memory leak in cachefiles_add_cache()
2024-03-06 14:36:10 +00:00
ceph
This is the 5.4.302 stable release
2025-12-03 14:36:44 +00:00
cifs
UPSTREAM: new helper: inode_wrong_type()
2026-05-08 21:46:14 +02:00
coda
configfs
configfs: Do not override creating attribute file failure in populate_attrs()
2025-06-27 11:02:50 +01:00
cramfs
cramfs: Verify inode mode when loading from disk
2025-10-29 13:59:55 +01:00
crypto
debugfs
devpts
dlm
dlm: check for defined force value in dlm_lockspace_release
2025-10-29 13:59:58 +01:00
ecryptfs
This is the 5.4.278 stable release
2024-06-18 14:18:49 +00:00
efivarfs
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
2025-09-04 14:05:55 +02:00
efs
erofs
Merge tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-02-06 22:53:05 +02:00
exfat
Merge branch 'for-kernel-version-from-4.1.0' of https://github.com/namjaejeon/linux-exfat-oot into android13-5.4-lahaina
2024-04-16 00:03:08 +03:00
exportfs
ext2
ext4
BACKPORT: mm: remove the pgprot argument to __vmalloc
2026-01-14 17:48:09 -08:00
f2fs
Merge tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-10-08 15:17:54 +03:00
fat
fat: fix uninitialized variable
2024-11-08 16:20:47 +01:00
freevxfs
fscache
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
fuse
UPSTREAM: fuse: fix readdir cache race
2026-05-08 21:46:18 +02:00
gfs2
BACKPORT: mm: remove the pgprot argument to __vmalloc
2026-01-14 17:48:09 -08:00
hfs
This is the 5.4.301 stable release
2025-10-30 07:52:10 +00:00
hfsplus
This is the 5.4.301 stable release
2025-10-30 07:52:10 +00:00
hostfs
hpfs
fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
2025-12-03 12:45:14 +01:00
hugetlbfs
mm/hugetlb: fix folio is still mapped when deleted
2025-10-02 13:34:35 +02:00
incfs
iomap
This is the 5.4.270 stable release
2024-03-05 14:53:04 +00:00
isofs
isofs: Verify inode mode when loading from disk
2025-08-28 16:21:15 +02:00
jbd2
jbd2: ensure that all ongoing I/O complete before freeing blocks
2025-10-29 14:00:01 +01:00
jffs2
This is the 5.4.295 stable release
2025-06-30 08:05:33 +00:00
jfs
This is the 5.4.302 stable release
2025-12-03 14:36:44 +00:00
kernfs
UPSTREAM: kernfs: Add option to enable user xattrs
2026-01-14 18:13:12 -08:00
lockd
minix
minixfs: Verify inode mode when loading from disk
2025-10-29 13:59:55 +01:00
nfs
UPSTREAM: new helper: inode_wrong_type()
2026-05-08 21:46:14 +02:00
nfs_common
nfsd
UPSTREAM: new helper: inode_wrong_type()
2026-05-08 21:46:14 +02:00
nilfs2
nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
2025-10-02 13:34:31 +02:00
nls
notify
ntfs
BACKPORT: mm: remove the pgprot argument to __vmalloc
2026-01-14 17:48:09 -08:00
ocfs2
This is the 5.4.301 stable release
2025-10-30 07:52:10 +00:00
omfs
openpromfs
openpromfs: finish conversion to the new mount API
2024-06-16 13:28:32 +02:00
orangefs
This is the 5.4.302 stable release
2025-12-03 14:36:44 +00:00
overlayfs
UPSTREAM: new helper: inode_wrong_type()
2026-05-08 21:46:14 +02:00
proc
FROMGIT: procfs: prevent unpriveleged processes accessing fdinfo dir
2026-05-07 10:19:32 -04:00
pstore
Merge tag 'ASB-2024-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2024-06-22 17:58:09 +03:00
qnx4
qnx6
quota
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
ramfs
reiserfs
romfs
squashfs
This is the 5.4.301 stable release
2025-10-30 07:52:10 +00:00
sysfs
This is the 5.4.275 stable release
2024-05-15 16:00:38 +00:00
sysv
sysv: don't call sb_bread() with pointers_lock held
2024-04-13 12:51:38 +02:00
tracefs
ubifs
BACKPORT: bdi: initialize ->ra_pages and ->io_pages in bdi_init
2026-05-08 21:46:13 +02:00
udf
fs: udf: fix OOB read in lengthAllocDescs handling
2025-10-29 13:59:54 +01:00
ufs
unicode
Revert "unicode: Don't special case ignorable code points"
2024-12-14 19:44:55 +01:00
verity
xfs
BACKPORT: mm: remove the pgprot argument to __vmalloc
2026-01-14 17:48:09 -08:00
aio.c
BACKPORT: FROMLIST: Revert "mremap: don't allow MREMAP_DONTUNMAP on special_mappings and aio"
2025-05-18 08:08:42 +00:00
anon_inodes.c
UPSTREAM: fs: anon_inodes: rephrase to appropriate kernel-doc
2025-02-20 04:17:46 +02:00
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf.c
binfmt_elf_fdpic.c
fs: binfmt_elf_efpic: don't use missing interpreter's properties
2024-09-04 13:14:54 +02:00
binfmt_em86.c
binfmt_flat.c
binfmt_flat: Fix integer overflow bug on 32 bit systems
2025-03-13 12:43:07 +01:00
binfmt_misc.c
binfmt_misc: cleanup on filesystem umount
2024-09-04 13:14:53 +02:00
binfmt_script.c
block_dev.c
block: Don't invalidate pagecache for invalid falloc modes
2024-01-08 11:29:48 +01:00
buffer.c
Merge tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-10-08 15:17:54 +03:00
char_dev.c
compat.c
compat_binfmt_elf.c
compat_ioctl.c
lsm: new security_file_ioctl_compat() hook
2024-02-23 08:25:15 +01:00
coredump.c
Revert "coredump: hand a pidfd to the usermode coredump helper"
2025-06-05 07:57:32 +00:00
d_path.c
dax.c
dcache.c
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
dcookies.c
direct-io.c
drop_caches.c
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
eventfd.c
eventpoll.c
UPSTREAM: epoll: add syscall epoll_pwait2
2025-12-22 04:28:19 +02:00
exec.c
This is the 5.4.301 stable release
2025-10-30 07:52:10 +00:00
fcntl.c
fs: Fix file_set_fowner LSM hook inconsistencies
2024-11-08 16:20:34 +01:00
fhandle.c
do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
2024-03-26 18:22:13 -04:00
file.c
UPSTREAM: fs: prevent out-of-bounds array speculation when closing a file descriptor
2026-01-18 00:27:36 -08:00
file_table.c
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
filesystems.c
fs/filesystems: Fix potential unsigned integer underflow in fs_name()
2025-06-27 11:02:50 +01:00
fs-writeback.c
fs/fs-writeback.c: adjust dirtytime_interval_handler definition to match prototype
2026-02-01 20:38:24 -08:00
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
inode.c
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
internal.h
io_uring.c
This is the 5.4.278 stable release
2024-06-18 14:18:49 +00:00
ioctl.c
Kconfig
Merge tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-06-30 10:49:17 +03:00
Kconfig.binfmt
libfs.c
UPSTREAM: fs: add LSM-supporting anon-inode interface
2025-02-20 04:17:45 +02:00
locks.c
filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
2024-09-04 13:15:02 +02:00
Makefile
mbcache.c
mount.h
mpage.c
namei.c
This is the 5.4.292 stable release
2025-04-11 08:16:05 +00:00
namespace.c
UPSTREAM: fuse: reject options on reconfigure via fsconfig(2)
2026-05-08 21:46:11 +02:00
no-block.c
nsfs.c
UPSTREAM: fs/nsfs.c: Added ns_match
2025-12-23 13:36:04 -08:00
open.c
UPSTREAM: close_range: add CLOSE_RANGE_UNSHARE
2025-12-22 03:48:31 +02:00
OWNERS
pipe.c
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
BACKPORT: vfs: add vfs_iocb_iter_[read|write] helper functions
2026-05-08 21:46:16 +02:00
readdir.c
select.c
fs/select: rework stack allocation hack for clang
2024-03-26 18:22:13 -04:00
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c
fs: explicitly unregister per-superblock BDIs
2024-11-08 16:20:26 +01:00
sync.c
This is the 5.4.263 stable release
2023-12-11 12:08:17 +00:00
timerfd.c
userfaultfd.c
Revert "mm: protect VMA modifications using VMA sequence count"
2025-05-24 05:44:09 +00:00
utimes.c
xattr.c
UPSTREAM: kernfs: Add removed_size out param for simple_xattr_set
2026-01-14 18:13:12 -08:00