From cad4f67e5b5bca9ee8ec716e7a153a92467c1c07 Mon Sep 17 00:00:00 2001 From: Biao Li Date: Wed, 4 Aug 2021 17:29:31 +0800 Subject: [PATCH] ANDROID: fuse: Allocate zeroed memory for canonical path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The page used to contain the fuse_dentry_canonical_path to be handled in fuse_dev_do_write is allocated using __get_free_pages(GFP_KERNEL). The returned page may contain undefined data, that by chance may be considered as a valid path name that is not in the cache. In that case, if the FUSE daemon mistakenly doesn't fill the canonical path buffer, the FUSE driver may fall into two blocking request_wait_answer(fuse_dev_write->kern_path->fuse_lookup_name) causing a deadlock condition. The stack is as follows： find S 0 20511 20117 0x00000000 Call trace: [] __switch_to+0xb8/0xd4 [] __schedule+0x458/0x714 [] schedule+0x8c/0xa8 [] request_wait_answer+0x74/0x220 [] __fuse_request_send+0x8c/0xa0 [] fuse_request_send+0x60/0x6c [] fuse_dentry_canonical_path+0xb8/0x104 [] do_sys_open+0x1b4/0x260 [] SyS_openat+0x3c/0x4c [] el0_svc_naked+0x34/0x38 mount.ntfs-3g S 0 5845 1 0x00000000 Call trace: [] __switch_to+0xb8/0xd4 [] __schedule+0x458/0x714 [] schedule+0x8c/0xa8 [] request_wait_answer+0x74/0x220 [] __fuse_request_send+0x8c/0xa0 [] fuse_request_send+0x60/0x6c [] fuse_simple_request+0x128/0x16c [] fuse_lookup_name+0x104/0x1b0 [] fuse_lookup+0x5c/0x11c [] lookup_slow+0xfc/0x174 [] walk_component+0xf0/0x290 [] path_lookupat+0xa0/0x128 [] filename_lookup+0x84/0x124 [] kern_path+0x44/0x54 [] fuse_dev_do_write+0x828/0xa0c [] fuse_dev_write+0x90/0xb4 [] do_iter_readv_writev+0xf4/0x13c [] do_readv_writev+0xec/0x220 [] vfs_writev+0x60/0x74 [] do_writev+0x7c/0x100 [] SyS_writev+0x38/0x48 [] el0_svc_naked+0x34/0x38 Fix by ensuring that the page allocated for the canonical path is zeroed. Bug: 194856119 Bug: 196051870 Fixes: 24ab59f6bb42 ("ANDROID: fuse: Add support for d_canonical_path") Signed-off-by: Biao Li Signed-off-by: Shuosheng Huang Signed-off-by: Alessio Balsini Change-Id: I400815dc1049d90c308f5cf87ce60de97ff82131 --- fs/fuse/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index baab6247381c..9c5a797b09e3 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -344,7 +344,7 @@ static void fuse_dentry_canonical_path(const struct path *path, char *path_name; int err; - path_name = (char *)__get_free_page(GFP_KERNEL); + path_name = (char *)get_zeroed_page(GFP_KERNEL); if (!path_name) goto default_path;