Miklos Szeredi
a9174077fe
fuse: fix pipe buffer lifetime for direct_io ...
commit 0c4bcfdecb1ac0967619ee7ff44871d93c08c909 upstream.
In FOPEN_DIRECT_IO mode, fuse_file_write_iter() calls
fuse_direct_write_iter(), which normally calls fuse_direct_io(), which then
imports the write buffer with fuse_get_user_pages(), which uses
iov_iter_get_pages() to grab references to userspace pages instead of
actually copying memory.
On the filesystem device side, these pages can then either be read to
userspace (via fuse_dev_read()), or splice()d over into a pipe using
fuse_dev_splice_read() as pipe buffers with &nosteal_pipe_buf_ops.
This is wrong because after fuse_dev_do_read() unlocks the FUSE request,
the userspace filesystem can mark the request as completed, causing write()
to return. At that point, the userspace filesystem should no longer have
access to the pipe buffer.
Fix by copying pages coming from the user address space to new pipe
buffers.
Reported-by: Jann Horn <jannh@google.com>
Fixes: c3021629a0
2022-03-16 13:21:47 +01:00
9P: Cast to loff_t before multiplying
2020-11-05 11:43:34 +01:00
fs/affs: release old buffer head on error path
2021-03-04 10:26:48 +01:00
afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation
2021-09-30 10:09:22 +02:00
bfs: don't use WARNING: string when it's just info.
2021-01-06 14:48:39 +01:00
btrfs: add missing run of delayed items after unlink during log replay
2022-03-08 19:07:50 +01:00
cachefiles: Handle readpage error correctly
2020-11-05 11:43:36 +01:00
ceph: fix handling of "meta" errors
2021-10-27 09:54:27 +02:00
cifs: fix double free race when mount fails in cifs_get_root()
2022-03-08 19:07:45 +01:00
configfs: fix a race in configfs_{,un}register_subsystem()
2022-03-02 11:41:10 +01:00
fscrypt: add fscrypt_symlink_getattr() for computing st_size
2021-09-12 08:56:38 +02:00
debugfs: lockdown: Allow reading debugfs files that are not world readable
2022-01-27 09:19:36 +01:00
fsnotify: fix fsnotify hooks in pseudo filesystems
2022-02-01 17:24:34 +01:00
fs: dlm: filter user dlm messages for kernel locks
2022-01-27 09:19:40 +01:00
Revert "ecryptfs: replace BUG_ON with error handling code"
2021-05-26 12:05:19 +02:00
efivarfs: revert "fix memory leak in efivarfs_create()"
2020-12-02 08:49:53 +01:00
erofs: fix unsafe pagevec reuse of hooked pclusters
2021-11-21 13:38:51 +01:00
ext2: fix sleeping in atomic bugs on error
2021-10-09 14:39:49 +02:00
ext4: prevent partial update of the extent blocks
2022-02-23 11:59:57 +01:00
f2fs: fix to reserve space for IO align feature
2022-01-27 09:19:53 +01:00
fscache: Fix cookie key hashing
2021-09-22 12:26:25 +02:00
fuse: fix pipe buffer lifetime for direct_io
2022-03-16 13:21:47 +01:00
gfs2: Fix length of holes reported at end-of-file
2021-12-08 09:01:08 +01:00
hfs: add lock nesting notation to hfs_find_init
2021-07-31 08:19:38 +02:00
hfsplus: prevent corruption in shrinking truncate
2021-05-19 10:08:29 +02:00
hostfs: fix memory handling in follow_link()
2021-04-14 08:24:14 +02:00
hugetlbfs: fix mount mode command line processing
2021-07-28 13:31:01 +02:00
mm/swap: consider max pages in iomap_swapfile_add_extent
2021-09-15 09:47:35 +02:00
isofs: Fix out of bound access for corrupted isofs image
2021-11-12 14:43:03 +01:00
jbd2: fix up sparse warnings in checkpoint code
2020-11-18 19:20:30 +01:00
jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
2022-01-27 09:19:45 +01:00
JFS: fix memleak in jfs_mount
2021-11-17 09:48:42 +01:00
lockd: lockd server-side shouldn't set fl_ops
2021-09-22 12:26:34 +02:00
NFS: Do not report writeback errors in nfs_getattr()
2022-02-23 11:59:59 +01:00
nfs_common: need lock during iterate through the list
2020-12-30 11:51:22 +01:00
NFSD: Fix offset type in I/O trace points
2022-02-16 12:52:47 +01:00
nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
2021-09-26 14:07:13 +02:00
ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type
2021-12-14 14:48:58 +01:00
ocfs2: fix data corruption on truncate
2021-11-17 09:48:17 +01:00
orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
2022-01-20 09:19:17 +01:00
ovl: fix warning in ovl_create_real()
2021-12-22 09:29:40 +01:00
proc/vmcore: fix clearing user buffer by properly using clear_user()
2021-12-01 09:23:31 +01:00
pstore: Fix typo in compression option name
2021-03-04 10:26:45 +01:00
qnx4: work around gcc false positive warning bug
2021-09-30 10:09:26 +02:00
quota: make dquot_quota_sync return errors from ->sync_fs
2022-02-23 11:59:55 +01:00
ramfs: fix nommu mmap with gaps in the page cache
2020-10-29 09:57:53 +01:00
reiserfs: check directory items on read from disk
2021-08-12 13:21:05 +02:00
squashfs: fix divide error in calculate_skip()
2021-05-19 10:08:29 +02:00
sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
2021-03-07 12:20:48 +01:00
tracefs: Set the group ownership in apply_options() not parse_options()
2022-03-02 11:41:13 +01:00
ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
2022-01-27 09:19:49 +01:00
udf: Fix NULL ptr deref when converting from inline format
2022-02-01 17:24:34 +01:00
fs-verity: fix signed integer overflow with i_size near S64_MAX
2021-10-06 15:42:30 +02:00
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
2022-01-11 15:23:32 +01:00
aio: fix use-after-free due to missing POLLFREE handling
2021-12-14 14:49:02 +01:00
elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
2021-10-06 15:42:35 +02:00
binfmt_misc: fix possible deadlock in bm_register_write
2021-03-17 17:03:57 +01:00
block: reexpand iov_iter after read/write
2021-05-22 11:38:29 +02:00
fs: Don't invalidate page buffers in block_write_full_page()
2020-11-05 11:43:24 +01:00
coredump: fix core_pattern parse error
2020-12-11 13:23:30 +01:00
fs: fix NULL dereference due to data race in prepend_path()
2020-10-29 09:57:45 +01:00
dax: fix ENOMEM handling in grab_mapping_entry()
2021-07-14 16:53:25 +02:00
fs: direct-io: fix missing sdio->boundary
2021-04-14 08:24:11 +02:00
vfs: check fd has read access in kernel_read_file_from_fd()
2021-10-27 09:54:27 +02:00
fcntl: fix potential deadlock for &fasync_struct.fa_lock
2021-09-15 09:47:28 +02:00
fget: clarify and improve __fget_files() implementation
2022-03-02 11:41:18 +01:00
writeback: fix obtain a reference to a freeing memcg css
2021-07-14 16:53:35 +02:00
memcg: charge fs_context and legacy_fs_context
2022-02-08 18:24:29 +01:00
cgroup1: fix leaked context root causing sporadic NULL deref in LTP
2021-07-31 08:19:37 +02:00
io_uring: Fix current->fs handling in io_sq_wq_submit_work()
2021-01-30 13:54:10 +01:00
libfs: fix error cast of negative value in simple_attr_write()
2020-11-24 13:29:19 +01:00
fsnotify: invalidate dcache before IN_DELETE event
2022-02-01 17:24:39 +01:00
fs: warn about impending deprecation of mandatory locks
2021-08-26 08:36:22 -04:00
pipe: increase minimum default pipe size to 2 pages
2021-08-12 13:21:02 +02:00
mount: fix mounting of detached mounts onto targets that reside on shared mounts
2021-03-17 17:03:33 +01:00
readdir: make sure to verify directory entry for legacy interfaces too
2021-04-21 12:56:16 +02:00
select: Fix indefinitely sleeping task in poll_schedule_timeout()
2022-01-29 10:25:11 +01:00
seq_file: disallow extremely large seq buffer allocations
2021-07-20 16:10:54 +02:00
signalfd: use wake_up_pollfree()
2021-12-14 14:49:02 +01:00
vfs: make freeze_super abort when sync_filesystem returns error
2022-02-23 11:59:55 +01:00
userfaultfd: prevent concurrent API initialization
2021-09-22 12:26:26 +02:00
a9174077fe