diff options
| author | Miklos Szeredi <mszeredi@redhat.com> | 2020-12-10 15:33:14 +0100 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@redhat.com> | 2020-12-10 15:33:14 +0100 |
| commit | 5d069dbe8aaf2a197142558b6fb2978189ba3454 (patch) | |
| tree | 4c9ddb84e8fde7b3120e76c733fca542a5ff7ca2 /kernel/exec_domain.c | |
| parent | 9d769e6aa2524e1762e3b8681e0ed78f8acf6cad (diff) | |
| download | linux-5d069dbe8aaf2a197142558b6fb2978189ba3454.tar.bz2 | |
fuse: fix bad inode
Jan Kara's analysis of the syzbot report (edited):
The reproducer opens a directory on FUSE filesystem, it then attaches
dnotify mark to the open directory. After that a fuse_do_getattr() call
finds that attributes returned by the server are inconsistent, and calls
make_bad_inode() which, among other things does:
inode->i_mode = S_IFREG;
This then confuses dnotify which doesn't tear down its structures
properly and eventually crashes.
Avoid calling make_bad_inode() on a live inode: switch to a private flag on
the fuse inode. Also add the test to ops which the bad_inode_ops would
have caught.
This bug goes back to the initial merge of fuse in 2.6.14...
Reported-by: syzbot+f427adf9324b92652ccc@syzkaller.appspotmail.com
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Tested-by: Jan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org>
Diffstat (limited to 'kernel/exec_domain.c')
0 files changed, 0 insertions, 0 deletions