[Devel] [PATCH RHEL7 COMMIT] ms/fuse: Fix use-after-free in fuse_dev_do_write()

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-862.14.4.vz7.72.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-862.14.4.vz7.72.2
------>
commit 33d05c255acb5373d399e1890f35d7f1ad801e9e
Author: Kirill Tkhai <ktkhai at virtuozzo.com>
Date:   Mon Oct 1 18:18:07 2018 +0300

    ms/fuse: Fix use-after-free in fuse_dev_do_write()
    
    After we found req in request_find() and released the lock,
    everything may happen with the req in parallel:
    
    cpu0                              cpu1
    fuse_dev_do_write()               fuse_dev_do_write()
      req = request_find(fpq, ...)    ...
      spin_unlock(&fpq->lock)         ...
      ...                             req = request_find(fpq, oh.unique)
      ...                             spin_unlock(&fpq->lock)
      queue_interrupt(&fc->iq, req);   ...
      ...                              ...
      ...                              ...
      request_end(fc, req);
        fuse_put_request(fc, req);
      ...                              queue_interrupt(&fc->iq, req);
    
    Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
    
    Signed-off-by: Miklos Szeredi <mszeredi at redhat.com>
    Fixes: 46c34a348b0a ("fuse: no fc->lock for pqueue parts")
    Cc: <stable at vger.kernel.org> # v4.2
    =====================
    Patchset description:
    
    Relax lock contention and ms fixes
    
    https://pmc.acronis.com/browse/VSTOR-9810
    
    Port some ms fixes and begin first round of relaxing fc->lock contention.
    
    Kirill Tkhai (5):
          fuse: Fix use-after-free in fuse_dev_do_read()
          fuse: Fix use-after-free in fuse_dev_do_write()
          fuse: use list_first_entry() in flush_bg_queue()
          fuse: use READ_ONCE on congestion_threshold and max_background
          fuse: add locking to max_background and congestion_threshold changes
    
    Miklos Szeredi (2):
          fuse: set FR_SENT while locked
          fuse: fix blocked_waitq wakeup
---
 fs/fuse/dev.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 7457ce96a4e0..332c6e6aea84 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -2010,16 +2010,20 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
 
 	/* Is it an interrupt reply ID? */
 	if (oh.unique & FUSE_INT_REQ_BIT) {
+		__fuse_get_request(req);
 		spin_unlock(&fpq->lock);
 
 		err = -EINVAL;
-		if (nbytes != sizeof(struct fuse_out_header))
+		if (nbytes != sizeof(struct fuse_out_header)) {
+			fuse_put_request(fc, req);
 			goto err_finish;
+		}
 
 		if (oh.error == -ENOSYS)
 			fc->no_interrupt = 1;
 		else if (oh.error == -EAGAIN)
 			queue_interrupt(req->fiq, req);
+		fuse_put_request(fc, req);
 
 		fuse_copy_finish(cs);
 		return nbytes;