Miklos Szeredi
a9174077fe
fuse: fix pipe buffer lifetime for direct_io ...
commit 0c4bcfdecb1ac0967619ee7ff44871d93c08c909 upstream.
In FOPEN_DIRECT_IO mode, fuse_file_write_iter() calls
fuse_direct_write_iter(), which normally calls fuse_direct_io(), which then
imports the write buffer with fuse_get_user_pages(), which uses
iov_iter_get_pages() to grab references to userspace pages instead of
actually copying memory.
On the filesystem device side, these pages can then either be read to
userspace (via fuse_dev_read()), or splice()d over into a pipe using
fuse_dev_splice_read() as pipe buffers with &nosteal_pipe_buf_ops.
This is wrong because after fuse_dev_do_read() unlocks the FUSE request,
the userspace filesystem can mark the request as completed, causing write()
to return. At that point, the userspace filesystem should no longer have
access to the pipe buffer.
Fix by copying pages coming from the user address space to new pipe
buffers.
Reported-by: Jann Horn <jannh@google.com>
Fixes: c3021629a0
2022-03-16 13:21:47 +01:00
9P: Cast to loff_t before multiplying
2020-11-05 11:43:34 +01:00
fs/affs: release old buffer head on error path
2021-03-04 10:26:48 +01:00
afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation
2021-09-30 10:09:22 +02:00
bfs: don't use WARNING: string when it's just info.
2021-01-06 14:48:39 +01:00
btrfs: add missing run of delayed items after unlink during log replay
2022-03-08 19:07:50 +01:00
cachefiles: Handle readpage error correctly
2020-11-05 11:43:36 +01:00
ceph: fix handling of "meta" errors
2021-10-27 09:54:27 +02:00
cifs: fix double free race when mount fails in cifs_get_root()
2022-03-08 19:07:45 +01:00
configfs: fix a race in configfs_{,un}register_subsystem()
2022-03-02 11:41:10 +01:00
fscrypt: add fscrypt_symlink_getattr() for computing st_size
2021-09-12 08:56:38 +02:00
debugfs: lockdown: Allow reading debugfs files that are not world readable
2022-01-27 09:19:36 +01:00
fsnotify: fix fsnotify hooks in pseudo filesystems
2022-02-01 17:24:34 +01:00
fs: dlm: filter user dlm messages for kernel locks
2022-01-27 09:19:40 +01:00
Revert "ecryptfs: replace BUG_ON with error handling code"
2021-05-26 12:05:19 +02:00
efivarfs: revert "fix memory leak in efivarfs_create()"
2020-12-02 08:49:53 +01:00
erofs: fix unsafe pagevec reuse of hooked pclusters
2021-11-21 13:38:51 +01:00
ext2: fix sleeping in atomic bugs on error
2021-10-09 14:39:49 +02:00
ext4: prevent partial update of the extent blocks
2022-02-23 11:59:57 +01:00
f2fs: fix to reserve space for IO align feature
2022-01-27 09:19:53 +01:00
fat: don't allow to mount if the FAT length == 0
2020-06-17 16:40:36 +02:00
fscache: Fix cookie key hashing
2021-09-22 12:26:25 +02:00
fuse: fix pipe buffer lifetime for direct_io
2022-03-16 13:21:47 +01:00
gfs2: Fix length of holes reported at end-of-file
2021-12-08 09:01:08 +01:00
hfs: add lock nesting notation to hfs_find_init
2021-07-31 08:19:38 +02:00
hfsplus: prevent corruption in shrinking truncate
2021-05-19 10:08:29 +02:00
hostfs: fix memory handling in follow_link()
2021-04-14 08:24:14 +02:00
hugetlbfs: fix mount mode command line processing
2021-07-28 13:31:01 +02:00
mm/swap: consider max pages in iomap_swapfile_add_extent
2021-09-15 09:47:35 +02:00
isofs: Fix out of bound access for corrupted isofs image
2021-11-12 14:43:03 +01:00
jbd2: fix up sparse warnings in checkpoint code
2020-11-18 19:20:30 +01:00
jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
2022-01-27 09:19:45 +01:00
JFS: fix memleak in jfs_mount
2021-11-17 09:48:42 +01:00
kernfs: do not call fsnotify() with name without a parent
2020-08-19 08:16:12 +02:00
lockd: lockd server-side shouldn't set fl_ops
2021-09-22 12:26:34 +02:00
fs/minix: remove expected error message in block_to_path()
2020-08-21 13:05:37 +02:00
NFS: Do not report writeback errors in nfs_getattr()
2022-02-23 11:59:59 +01:00
nfs_common: need lock during iterate through the list
2020-12-30 11:51:22 +01:00
NFSD: Fix offset type in I/O trace points
2022-02-16 12:52:47 +01:00
nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
2021-09-26 14:07:13 +02:00
fanotify: fix ignore mask logic for events on child and on dir
2020-06-17 16:40:24 +02:00
ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type
2021-12-14 14:48:58 +01:00
ocfs2: fix data corruption on truncate
2021-11-17 09:48:17 +01:00
orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
2022-01-20 09:19:17 +01:00
ovl: fix warning in ovl_create_real()
2021-12-22 09:29:40 +01:00
proc/vmcore: fix clearing user buffer by properly using clear_user()
2021-12-01 09:23:31 +01:00
pstore: Fix typo in compression option name
2021-03-04 10:26:45 +01:00
qnx4: work around gcc false positive warning bug
2021-09-30 10:09:26 +02:00
quota: make dquot_quota_sync return errors from ->sync_fs
2022-02-23 11:59:55 +01:00
ramfs: fix nommu mmap with gaps in the page cache
2020-10-29 09:57:53 +01:00
reiserfs: check directory items on read from disk
2021-08-12 13:21:05 +02:00
romfs: fix uninitialized memory leak in romfs_dev_read()
2020-08-26 10:40:51 +02:00
squashfs: fix divide error in calculate_skip()
2021-05-19 10:08:29 +02:00
sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
2021-03-07 12:20:48 +01:00
tracefs: Set the group ownership in apply_options() not parse_options()
2022-03-02 11:41:13 +01:00
ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
2022-01-27 09:19:49 +01:00
udf: Fix NULL ptr deref when converting from inline format
2022-02-01 17:24:34 +01:00
fs/ufs: avoid potential u32 multiplication overflow
2020-08-21 13:05:37 +02:00
fs-verity: fix signed integer overflow with i_size near S64_MAX
2021-10-06 15:42:30 +02:00
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
2022-01-11 15:23:32 +01:00
aio: fix use-after-free due to missing POLLFREE handling
2021-12-14 14:49:02 +01:00
utimes: Clamp the timestamps in notify_change()
2020-02-11 04:35:12 -08:00
elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
2021-10-06 15:42:35 +02:00
binfmt_flat: revert "binfmt_flat: don't offset the data start"
2020-09-03 11:26:39 +02:00
binfmt_misc: fix possible deadlock in bm_register_write
2021-03-17 17:03:57 +01:00
block: reexpand iov_iter after read/write
2021-05-22 11:38:29 +02:00
fs: Don't invalidate page buffers in block_write_full_page()
2020-11-05 11:43:24 +01:00
coredump: fix core_pattern parse error
2020-12-11 13:23:30 +01:00
fs: fix NULL dereference due to data race in prepend_path()
2020-10-29 09:57:45 +01:00
dax: fix ENOMEM handling in grab_mapping_entry()
2021-07-14 16:53:25 +02:00
fix dget_parent() fastpath race
2020-10-01 13:17:19 +02:00
fs: direct-io: fix missing sdio->boundary
2021-04-14 08:24:11 +02:00
eventfd: track eventfd_signal() recursion depth
2020-02-11 04:35:37 -08:00
ep_create_wakeup_source(): dentry name can change under you...
2020-10-07 08:01:31 +02:00
vfs: check fd has read access in kernel_read_file_from_fd()
2021-10-27 09:54:27 +02:00
fcntl: fix potential deadlock for &fasync_struct.fa_lock
2021-09-15 09:47:28 +02:00
fget: clarify and improve __fget_files() implementation
2022-03-02 11:41:18 +01:00
fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
2020-04-17 10:50:21 +02:00
writeback: fix obtain a reference to a freeing memcg css
2021-07-14 16:53:35 +02:00
memcg: charge fs_context and legacy_fs_context
2022-02-08 18:24:29 +01:00
futex: Fix inode life-time issue
2020-03-25 08:25:58 +01:00
cgroup1: fix leaked context root causing sporadic NULL deref in LTP
2021-07-31 08:19:37 +02:00
io_uring: Fix current->fs handling in io_sq_wq_submit_work()
2021-01-30 13:54:10 +01:00
libfs: fix error cast of negative value in simple_attr_write()
2020-11-24 13:29:19 +01:00
locks: reinstate locks_delete_block optimization
2020-03-25 08:25:41 +01:00
fsnotify: invalidate dcache before IN_DELETE event
2022-02-01 17:24:39 +01:00
fs: warn about impending deprecation of mandatory locks
2021-08-26 08:36:22 -04:00
cifs_atomic_open(): fix double-put on late allocation failure
2020-03-18 07:17:51 +01:00
pipe: increase minimum default pipe size to 2 pages
2021-08-12 13:21:02 +02:00
propagate_one(): mnt_set_mountpoint() needs mount_lock
2020-05-02 08:48:44 +02:00
mount: fix mounting of detached mounts onto targets that reside on shared mounts
2021-03-17 17:03:33 +01:00
fs: allow deduplication of eof block into the end of the destination file
2020-02-11 04:35:23 -08:00
readdir: make sure to verify directory entry for legacy interfaces too
2021-04-21 12:56:16 +02:00
select: Fix indefinitely sleeping task in poll_schedule_timeout()
2022-01-29 10:25:11 +01:00
seq_file: disallow extremely large seq buffer allocations
2021-07-20 16:10:54 +02:00
signalfd: use wake_up_pollfree()
2021-12-14 14:49:02 +01:00
vfs: make freeze_super abort when sync_filesystem returns error
2022-02-23 11:59:55 +01:00
userfaultfd: prevent concurrent API initialization
2021-09-22 12:26:26 +02:00
utimes: Clamp the timestamps in notify_change()
2020-02-11 04:35:12 -08:00
xattr: break delegations in {set,remove}xattr
2020-08-11 15:33:39 +02:00
a9174077fe