fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req

When fuse_resend() moves a request from fpq->processing back to
fiq->pending, it sets FR_PENDING and clears FR_SENT but does not
remove the requests intr_entry from fiq->interrupts.  If the
request had FR_INTERRUPTED set from a prior signal, intr_entry
remains dangling on fiq->interrupts.  When the requesting task
then receives a fatal signal, fuse_remove_pending_req() sees
FR_PENDING=1, removes the request from fiq->pending and frees it
via the refcount path, also without cleaning intr_entry.  The
stale intr_entry causes use-after-free when fuse_read_interrupt()
iterates fiq->interrupts:
  - list_del_init(&req->intr_entry) -> UAF write on freed slab
  - req->in.h.unique -> UAF read, data leaked to userspace

Remove intr_entry from fiq->interrupts in fuse_resend() for
interrupted requests before they are placed back on fiq->pending.

Add a WARN_ON if the intr_entry is not empty on request destruction.

Fixes: 760eac73f9f6 ("fuse: Introduce a new notification type for resend pending requests")
Cc: stable@vger.kernel.org # 6.9
Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index b527d90ef74bacdc0630d3ecea6854db5e6ae58e..296cdb696f587264b4f49a7e7d7a4eeb62040761 100644 (file)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -148,6 +148,7 @@ static struct fuse_req *fuse_request_alloc(struct fuse_mount *fm, gfp_t flags)
 
 static void fuse_request_free(struct fuse_req *req)
 {
+       WARN_ON(!list_empty(&req->intr_entry));
        kmem_cache_free(fuse_req_cachep, req);
 }
 
@@ -2023,6 +2024,14 @@ static void fuse_resend(struct fuse_conn *fc)
                fuse_dev_end_requests(&to_queue);
                return;
        }
+       /*
+        * Remove interrupt entries for resent requests to prevent stale
+        * intr_entry on fiq->interrupts after the request is re-queued.
+        */
+       list_for_each_entry(req, &to_queue, list) {
+               if (test_bit(FR_INTERRUPTED, &req->flags))
+                       list_del_init(&req->intr_entry);
+       }
        /* iq and pq requests are both oldest to newest */
        list_splice(&to_queue, &fiq->pending);
        fuse_dev_wake_and_unlock(fiq);