Joanne KoongandGreg Kroah-Hartman 1ca605cfa5 fuse: re-lock request before returning from fuse_ref_folio() ...

commit b5befa80fd upstream.

fuse_ref_folio() unlocks the request but does not re-lock it before
returning. fuse_chan_abort() can end the request and the async end
callback (eg fuse_writepage_free()) can free the args while the
subsequent copy chain logic after fuse_ref_folio() accesses them,
leading to use-after-free issues.

Fix this by locking the request in fuse_ref_folio() before returning.

Fixes: c3021629a0 ("fuse: support splice() reading from fuse device")
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-07-24 15:54:30 +02:00

..

acl.c

…

control.c

fuse: quiet down complaints in fuse_conn_limit_write

2026-06-01 17:38:42 +02:00

cuse.c

fuse: fix device node leak in cuse_process_init_reply()

2026-07-24 15:54:30 +02:00

dax.c

fuse: fix dax truncate/punch_hole fault path

2025-04-10 14:33:36 +02:00

dev.c

fuse: re-lock request before returning from fuse_ref_folio()

2026-07-24 15:54:30 +02:00

dir.c

fuse: allocate ff->release_args only if release is needed

2025-10-29 14:04:40 +01:00

file.c

virtiofs: fix UAF on submount umount

2026-07-04 13:41:29 +02:00

fuse_i.h

fuse: allocate ff->release_args only if release is needed

2025-10-29 14:04:40 +01:00

inode.c

…

ioctl.c

…

Kconfig

…

Makefile

…

readdir.c

fuse: reject oversized dirents in page cache

2026-06-01 17:38:42 +02:00

virtio_fs.c

virtiofs: add filesystem context source name check

2025-04-25 10:43:55 +02:00

xattr.c

…