linux-kernel - Re: Still a pretty bad time on 5.4.6 with fuse_request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 12 Feb 2020 20:36:11 +0100
From:   Miklos Szeredi <miklos@...redi.hu>
To:     Michael Stapelberg <michael+lkml@...pelberg.ch>
Cc:     fuse-devel <fuse-devel@...ts.sourceforge.net>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Kyle Sanderson <kyle.leet@...il.com>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: Still a pretty bad time on 5.4.6 with fuse_request_end.

On Wed, Feb 12, 2020 at 10:38 AM Michael Stapelberg
<michael+lkml@...pelberg.ch> wrote:
>
> Unfortunately not: when I change the code like so:
>
>     bool async;
>     uint32_t opcode_early = req->args->opcode;
>
>     if (test_and_set_bit(FR_FINISHED, &req->flags))
>         goto put_request;
>
>     async = req->args->end;
>
> …gdb only reports:
>
> (gdb) bt
> #0  0x000000a700000001 in ?? ()
> #1  0xffffffff8137fc99 in fuse_copy_finish (cs=0x20000ffffffff) at
> fs/fuse/dev.c:681
> Backtrace stopped: previous frame inner to this frame (corrupt stack?)
>
> But maybe that’s a hint in and of itself?

Yep, it's a stack use after return bug.   Attached patch should fix
it, though I haven't tested it.

Thanks,
Miklos

View attachment "fuse-fix-stack-use-after-return.patch" of type "text/x-patch" (1488 bytes)