Miklos Szeredi 11c6fc8be6 fuse: fix page dereference after free ...

After unlock_request() pages from the ap->pages[] array may be put (e.g. by
aborting the connection) and the pages can be freed.

Prevent use after free by grabbing a reference to the page before calling
unlock_request().

The original patch was created by Pradeep P V K.

Change-Id: I895fe861028b40a1930b9600436ef6d34c02d7c3
Reported-by: Pradeep P V K <ppvk@codeaurora.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Patch-mainline: linux-fsdevel@vger.kernel.org @ 14/09/2020, 13:41
Signed-off-by: Pradeep P V K <ppvk@codeaurora.org>

2020-09-21 16:08:56 +05:30

..

acl.c

…

control.c

fuse: use READ_ONCE on congestion_threshold and max_background

2019-11-20 18:47:53 +01:00

cuse.c

fuse: fix memleak in cuse_channel_open

2019-10-11 18:21:20 +02:00

dev.c

fuse: fix page dereference after free

2020-09-21 16:08:56 +05:30

dir.c

Merge android-4.19-q.89 (c79e0f8) into msm-4.19

2020-01-28 03:22:36 -08:00

file.c

Fixing Android Net Test compilation

2020-03-21 18:06:06 -07:00

fuse_i.h

Merge android-4.19-q.89 (c79e0f8) into msm-4.19

2020-01-28 03:22:36 -08:00

inode.c

fuse: fix deadlock with aio poll and fuse_iqueue::waitq.lock

2019-10-05 13:10:13 +02:00

Kconfig

…

Makefile

…

xattr.c

…