From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Miklos Szeredi <mszeredi@redhat.com>,
Sasha Levin <sashal@kernel.org>,
linux-fsdevel@vger.kernel.org
Subject: [PATCH AUTOSEL 4.4 12/19] cuse: prevent clone
Date: Wed, 5 May 2021 12:41:55 -0400 [thread overview]
Message-ID: <20210505164203.3464510-12-sashal@kernel.org> (raw)
In-Reply-To: <20210505164203.3464510-1-sashal@kernel.org>
From: Miklos Szeredi <mszeredi@redhat.com>
[ Upstream commit 8217673d07256b22881127bf50dce874d0e51653 ]
For cloned connections cuse_channel_release() will be called more than
once, resulting in use after free.
Prevent device cloning for CUSE, which does not make sense at this point,
and highly unlikely to be used in real life.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/cuse.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index d9aba9700726..b83367300f48 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -616,6 +616,8 @@ static int __init cuse_init(void)
cuse_channel_fops.owner = THIS_MODULE;
cuse_channel_fops.open = cuse_channel_open;
cuse_channel_fops.release = cuse_channel_release;
+ /* CUSE is not prepared for FUSE_DEV_IOC_CLONE */
+ cuse_channel_fops.unlocked_ioctl = NULL;
cuse_class = class_create(THIS_MODULE, "cuse");
if (IS_ERR(cuse_class))
--
2.30.2
next prev parent reply other threads:[~2021-05-05 17:21 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-05 16:41 [PATCH AUTOSEL 4.4 01/19] fs: dlm: fix debugfs dump Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 02/19] tipc: convert dest node's address to network order Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 03/19] net: stmmac: Set FIFO sizes for ipq806x Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 04/19] ALSA: hdsp: don't disable if not enabled Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 05/19] ALSA: hdspm: " Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 06/19] ALSA: rme9652: " Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 07/19] Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 08/19] Bluetooth: verify AMP hci_chan before amp_destroy Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 09/19] Bluetooth: initialize skb_queue_head at l2cap_chan_create() Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 10/19] ip6_vti: proper dev_{hold|put} in ndo_[un]init methods Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 11/19] mac80211: clear the beacon's CRC after channel switch Sasha Levin
2021-05-05 16:41 ` Sasha Levin [this message]
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 13/19] selftests: Set CC to clang in lib.mk if LLVM is set Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 14/19] kconfig: nconf: stop endless search loops Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 15/19] sctp: Fix out-of-bounds warning in sctp_process_asconf_param() Sasha Levin
2021-05-05 16:41 ` [PATCH AUTOSEL 4.4 16/19] ASoC: rt286: Generalize support for ALC3263 codec Sasha Levin
2021-05-05 16:42 ` [PATCH AUTOSEL 4.4 17/19] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt Sasha Levin
2021-05-05 16:42 ` [PATCH AUTOSEL 4.4 18/19] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join Sasha Levin
2021-05-05 16:42 ` [PATCH AUTOSEL 4.4 19/19] powerpc/iommu: Annotate nested lock for lockdep Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210505164203.3464510-12-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mszeredi@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).