Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/fs
History
Miklos Szeredi e09412a714 virtiofs: fix UAF on submount umount 
commit 06b41351779e9289e8785694ade9042ae85e41ea upstream.

iput() called from fuse_release_end() can Oops if the super block has
already been destroyed.  Normally this is prevented by waiting for
num_waiting to go down to zero before commencing with super block shutdown.

This only works, however, for the last submount instance, as the wait
counter is per connection, not per superblock.

Revert to using synchronous release requests for the auto_submounts case,
which is virtiofs only at this time.

Reported-by: Aurélien Bombo <abombo@microsoft.com>
Reported-by: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: Greg Kurz <gkurz@redhat.com>
Closes: https://github.com/kata-containers/kata-containers/issues/12589
Fixes: 26e5c67deb ("fuse: fix livelock in synchronous file put from fuseblk workers")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kurz <gkurz@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-27 11:08:18 +01:00
..
9p netfs: Fix potential for tearing in ->remote_i_size and ->zero_point 2026-05-12 14:42:30 +02:00
adfs ARM development for 7.1-rc1 2026-04-25 07:44:26 -07:00
affs Fixing livelocks in shrink_dcache_tree() 2026-04-21 07:30:44 -07:00
afs afs: Fix the locking used by afs_get_link() 2026-05-12 14:42:33 +02:00
autofs vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
befs treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
bfs vfs-7.1-rc1.bh.metadata 2026-04-13 12:46:42 -07:00
btrfs for-7.1-rc4-tag 2026-05-23 16:54:48 -07:00
cachefiles cachefiles: Fix error return when vfs_mkdir() fails 2026-05-15 15:32:43 +02:00
ceph ceph: put folios not suitable for writeback 2026-05-11 10:39:22 +02:00
coda coda cleanups and fixes 2026-04-21 14:03:10 -07:00
configfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cramfs treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
crypto fscrypt updates for 7.1 2026-04-13 17:29:12 -07:00
debugfs debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() 2026-04-02 16:15:23 +02:00
devpts Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dlm ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs 2026-03-29 11:21:22 -07:00
ecryptfs eCryptfs changes for 7.1-rc1 2026-04-20 10:54:17 -07:00
efivarfs efivarfs: use QSTR() in efivarfs_alloc_dentry 2026-04-28 12:30:59 +02:00
efs treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
erofs erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check() 2026-06-02 01:52:58 +08:00
exfat Description for this pull request: 2026-04-13 16:57:31 -07:00
exportfs Fixing livelocks in shrink_dcache_tree() 2026-04-21 07:30:44 -07:00
ext2 \n 2026-04-15 19:22:16 -07:00
ext4 Various clean ups and bug fixes in ext4 for 7.1: 2026-04-17 17:08:31 -07:00
f2fs f2fs-for-7.1-rc1 2026-04-21 14:50:04 -07:00
fat vfs-7.1-rc1.bh.metadata 2026-04-13 12:46:42 -07:00
freevxfs treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
fuse virtiofs: fix UAF on submount umount 2026-06-27 11:08:18 +01:00
gfs2 gfs2 changes 2026-04-15 19:12:04 -07:00
hfs vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
hfsplus hfs/hfsplus updates for v7.1 2026-04-13 16:50:38 -07:00
hostfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hpfs hpfs: fix a crash if hpfs_map_dnode_bitmap fails 2026-05-25 14:48:58 +02:00
hugetlbfs Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" 2026-05-21 19:06:11 -07:00
iomap vfs-7.1-rc7.fixes 2026-06-06 07:28:59 -07:00
isofs isofs: use QSTR_LEN() in isofs_cmp 2026-04-20 17:27:28 +02:00
jbd2 Various clean ups and bug fixes in ext4 for 7.1: 2026-04-17 17:08:31 -07:00
jffs2 treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
jfs fs: Fix return in jfs_mkdir and orangefs_mkdir 2026-05-11 14:19:01 +02:00
kernfs Driver core changes for 7.1-rc1 2026-04-13 19:03:11 -07:00
lockd nfsd-7.1 fixes: 2026-05-26 13:49:13 -07:00
minix vfs-7.1-rc1.bh.metadata 2026-04-13 12:46:42 -07:00
netfs netfs, afs: Fix write skipping in dir/link writepages 2026-05-12 14:42:32 +02:00
nfs NFS: write_completion: dereference loop-local req, not hdr->req 2026-06-02 10:27:45 +02:00
nfs_common
nfsd Revert "NFSD: Defer sub-object cleanup in export put callbacks" 2026-06-27 11:08:17 +01:00
nilfs2 mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
nls
notify \n 2026-04-27 16:40:24 -07:00
ntfs ntfs: restore $MFT mirror contents check 2026-05-11 23:30:48 +09:00
ntfs3 Changes for 7.1-rc1 2026-04-20 10:59:47 -07:00
ocfs2 Fixing livelocks in shrink_dcache_tree() 2026-04-21 07:30:44 -07:00
omfs vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
openpromfs
orangefs fs: Fix return in jfs_mkdir and orangefs_mkdir 2026-05-11 14:19:01 +02:00
overlayfs ovl: keep err zero after successful ovl_cache_get() 2026-05-18 14:56:15 +02:00
proc mm.git review status for linus..mm-nonmm-stable 2026-04-16 20:11:56 -07:00
pstore mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
qnx4 vfs-7.1-rc1.bh.metadata 2026-04-13 12:46:42 -07:00
qnx6 fs/qnx6: fix pointer arithmetic in directory iteration 2026-05-28 14:16:33 +02:00
quota quota: Fix race of dquot_scan_active() with quota deactivation 2026-03-25 13:15:36 +01:00
ramfs folio_batch: rename pagevec.h to folio_batch.h 2026-04-05 13:53:07 -07:00
resctrl mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
romfs
smb ksmbd: reject non-VALID session in compound request branch 2026-06-27 11:08:17 +01:00
squashfs Squashfs: check metadata block offset is within range 2026-02-24 11:13:27 -08:00
sysfs sysfs: don't remove existing directory on update failure 2026-05-20 17:13:20 +02:00
tests fs/tests: exec: Remove bad test vector 2026-03-18 11:41:53 -07:00
tracefs tracefs fixes for v7.1: 2026-04-22 15:09:01 -07:00
ubifs mm.git review status for linus..mm-nonmm-stable 2026-04-16 20:11:56 -07:00
udf udf: reject descriptors with oversized CRC length 2026-04-22 17:14:48 +02:00
ufs vfs-7.1-rc1.bh.metadata 2026-04-13 12:46:42 -07:00
unicode Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vboxsf Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
verity vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
xfs xfs: Remove mention of PageWriteback 2026-05-30 08:26:18 +02:00
zonefs zonefs: handle integer overflow in zonefs_fname_to_fno 2026-05-12 07:53:20 +09:00
aio.c fs: aio: reject partial mremap to avoid Null-pointer-dereference error 2026-04-24 00:34:59 +02:00
anon_inodes.c
attr.c fs: attr: fix comment formatting and spelling issues 2026-04-07 11:26:11 +02:00
backing-file.c lsm: add backing_file LSM hooks 2026-04-03 16:53:50 -04:00
bad_inode.c
binfmt_elf.c mm: unexport vm_brk_flags() and eliminate vm_flags parameter 2026-04-05 13:53:39 -07:00
binfmt_elf_fdpic.c vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
binfmt_flat.c
binfmt_misc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
binfmt_script.c
bpf_fs_kfuncs.c
buffer.c vfs-7.1-rc1.fixes 2026-04-23 17:08:04 -07:00
char_dev.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
compat_binfmt_elf.c
coredump.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
d_path.c dcache: permit dynamic_dname()s up to NAME_MAX 2026-04-07 12:32:22 +02:00
dax.c dax changes for 7.1 2026-04-21 14:12:01 -07:00
dcache.c Fixing livelocks in shrink_dcache_tree() 2026-04-21 07:30:44 -07:00
direct-io.c
drop_caches.c
eventfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
eventpoll.c eventpoll: drop vestigial epi->dying flag 2026-04-24 00:37:01 +02:00
exec.c exec: use strnlen() in __set_task_comm 2026-04-01 12:26:07 -07:00
fcntl.c fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling 2026-06-19 13:50:57 +02:00
fhandle.c fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() 2026-06-04 09:39:50 +02:00
file.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
file_attr.c vfs-7.0-rc2.fixes 2026-02-25 10:34:23 -08:00
file_table.c lsm/stable-7.1 PR 20260410 2026-04-13 15:17:28 -07:00
filesystems.c
fs-writeback.c vfs-7.1-rc1.fixes 2026-04-23 17:08:04 -07:00
fs_context.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
fs_dirent.c
fs_parser.c fs: remove fsparam_path / fs_param_is_path 2026-02-19 14:34:26 +01:00
fs_pin.c
fs_struct.c
fserror.c treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
fsopen.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
init.c
inode.c fs: fix forced iversion increment on lazytime timestamp updates 2026-05-11 15:32:12 +02:00
internal.h lsm/stable-7.1 PR 20260410 2026-04-13 15:17:28 -07:00
ioctl.c
Kconfig ntfs: add Kconfig and Makefile 2026-02-19 21:51:00 +09:00
Kconfig.binfmt
kernel_read_file.c
libfs.c vfs-7.1-rc1.bh.metadata 2026-04-13 12:46:42 -07:00
locks.c NFSD 7.1 Release Notes 2026-04-20 10:44:02 -07:00
Makefile ntfs: add Kconfig and Makefile 2026-02-19 21:51:00 +09:00
mbcache.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
mnt_idmapping.c fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap 2026-05-11 14:19:01 +02:00
mount.h fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() 2026-06-04 09:39:50 +02:00
mpage.c mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
namei.c VFS: fix possible failure to unlock in nfsd4_create_file() 2026-05-28 14:14:04 +02:00
namespace.c namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories 2026-06-10 07:09:20 -07:00
nsfs.c nsfs: fix wrong error code returned for pidns ioctls 2026-05-11 15:59:14 +02:00
nullfs.c
open.c fs: remove do_sys_truncate 2026-03-23 12:41:58 +01:00
pidfs.c vfs-7.1-rc1.pidfs 2026-04-13 13:27:11 -07:00
pipe.c treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
pnode.c
pnode.h
posix_acl.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
proc_namespace.c
read_write.c
readdir.c fs: Replace user_access_{begin/end} by scoped user access 2026-03-24 14:44:02 +01:00
remap_range.c
select.c fs/select: reject negative timeval components in kern_select() 2026-05-12 14:41:40 +02:00
seq_file.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
signalfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
splice.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
stack.c
stat.c
statfs.c
super.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sync.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
sysctls.c
timerfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
userfaultfd.c userfaultfd: allow registration of ranges below mmap_min_addr 2026-04-18 00:10:56 -07:00
utimes.c
xattr.c xattr: support extended attributes on sockets 2026-03-02 11:06:42 +01:00