Pull fuse fixes from Miklos Szeredi: "Fix a use after free bug introduced in 4.2 and using an uninitialized value introduced in 4.9" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: fix uninitialized flags in pipe_buffer fuse: fix use after free issue in fuse_dev_do_read()
Unified · Split
| @@ -399,6 +399,10 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) · 398 unmodified lines | ||
| 399 | 399 | static void queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) |
| 400 | 400 | { |
| 401 | 401 | spin_lock(&fiq->waitq.lock); |
| 402 | + if (test_bit(FR_FINISHED, &req->flags)) { | |
| 403 | + spin_unlock(&fiq->waitq.lock); | |
| 404 | + return; | |
| 405 | + } | |
| 402 | 406 | if (list_empty(&req->intr_entry)) { |
| 403 | 407 | list_add_tail(&req->intr_entry, &fiq->interrupts); |
| 404 | 408 | wake_up_locked(&fiq->waitq); |
| @@ -1372,6 +1376,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos, · 967 unmodified lines | ||
| 1372 | 1376 | * code can Oops if the buffer persists after module unload. |
| 1373 | 1377 | */ |
| 1374 | 1378 | bufs[page_nr].ops = &nosteal_pipe_buf_ops; |
| 1379 | + bufs[page_nr].flags = 0; | |
| 1375 | 1380 | ret = add_to_pipe(pipe, &bufs[page_nr++]); |
| 1376 | 1381 | if (unlikely(ret < 0)) |
| 1377 | 1382 | break; |