linux-ext4 - [PATCH 11/8] fuse2fs: fix race condition in op

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250709165152.GE2672022@frogsfrogsfrogs>
Date: Wed, 9 Jul 2025 09:51:52 -0700
From: "Darrick J. Wong" <djwong@...nel.org>
To: tytso@....edu
Cc: linux-ext4@...r.kernel.org
Subject: [PATCH 11/8] fuse2fs: fix race condition in op_destroy

From: Darrick J. Wong <djwong@...nel.org>

On a regular fuse server (i.e. one not running in fuseblk mode), libfuse
synthesizes and dispatches a FUSE_DESTROY command as soon as the event
dispatch loop terminates after the kernel disconnects /dev/fuse.
Unfortunately, this is done without coordinating with any other threads
that may have already received a real FUSE command from the kernel.

In other words, FUSE_DESTROY can run in parallel with other
fuse_operations.  Therefore, we must guard the body of this function
with the BKL just like any other fuse operation or risk races within
libext2fs.  If we're lucky, we trash the ext2_filsys state and
generic/488 will crash.

[23512.452451] [U] fuse: reading device: Software caused connection abort
[23512.453886] [U] fuse: reading device: Software caused connection abort

If we're not lucky, it corrupts the ondisk filesystem resulting in a
e2fsck complaining as well.

Cc: <linux-ext4@...r.kernel.org> # v1.43
Fixes: 81cbf1ef4f5dab ("misc: add fuse2fs, a FUSE server for e2fsprogs")
Signed-off-by: "Darrick J. Wong" <djwong@...nel.org>
---
 misc/fuse2fs.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/misc/fuse2fs.c b/misc/fuse2fs.c
index ff8d4668cee217..f0250bd1cec2ec 100644
--- a/misc/fuse2fs.c
+++ b/misc/fuse2fs.c
@@ -728,7 +728,10 @@ static void op_destroy(void *p EXT2FS_ATTR((unused)))
 		translate_error(global_fs, 0, EXT2_ET_BAD_MAGIC);
 		return;
 	}
+
+	pthread_mutex_lock(&ff->bfl);
 	fs = ff->fs;
+
 	dbg_printf(ff, "%s: dev=%s\n", __func__, fs->device_name);
 	if (fs->flags & EXT2_FLAG_RW) {
 		fs->super->s_state |= EXT2_VALID_FS;
@@ -763,6 +766,8 @@ static void op_destroy(void *p EXT2FS_ATTR((unused)))
 		uuid_unparse(fs->super->s_uuid, uuid);
 		log_printf(ff, "%s %s.\n", _("unmounting filesystem"), uuid);
 	}
+
+	pthread_mutex_unlock(&ff->bfl);
 }

 static void *op_init(struct fuse_conn_info *conn