mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-28 07:33:45 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
1efd3d474fc0ba74dfd984249bca78807d739812
linux/fs
History
Bernd Schubert 1efd3d474f fuse-uring: make a fuse_req on SQE commit only findable after memcpy 
Bad userspace might try to trick us and send commit SQEs request
unique / commit-id of requests that are not even send to
fuse-server (io_uring_cmd_done() not called) yet.

fuse_uring_commit_fetch() ends the fuse request when the ring entry
has a wrong state, but that could have caused a use-after-free
with the memcpy operations in fuse_uring_send_in_task().
In order to avoid such races the call of fuse_uring_add_to_pq()
is moved after the copy operations and just before completing
the io-uring request - malicious userspace cannot find the request
anymore until all prepration work in fuse-client/kernel is completed.

This also moves fuse_uring_add_to_pq() a bit up in the code to
avoid a forward declaration. Also not with a preparation commit,
to make it easier to back port to older kernels.

Reported-by: xlabai <xlabai@tencent.com>
Reported-by: Berkant Koc <me@berkoc.com>
Fixes: c090c8abae ("fuse: Add io-uring sqe commit and fetch support")
Cc: stable@kernel.org # 6.14
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Reviewed-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-06-15 14:06:14 +02:00
..
9p
Merge tag '9p-for-7.1-rc1' of https://github.com/martinetd/linux
2026-04-24 13:37:26 -07:00
adfs
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux
2026-04-25 07:44:26 -07:00
affs
Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-04-21 07:30:44 -07:00
afs
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
autofs
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
befs
treewide: change inode->i_ino from unsigned long to u64
2026-03-06 14:31:28 +01:00
bfs
Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:46:42 -07:00
btrfs
Merge tag 'trace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
2026-04-17 09:43:12 -07:00
cachefiles
Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:19:01 -07:00
ceph
Merge tag 'ceph-for-7.1-rc1' of https://github.com/ceph/ceph-client
2026-04-24 13:47:19 -07:00
coda
Merge tag 'pull-coda' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-04-21 14:03:10 -07:00
configfs
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
cramfs
treewide: change inode->i_ino from unsigned long to u64
2026-03-06 14:31:28 +01:00
crypto
Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux
2026-04-13 17:29:12 -07:00
debugfs
debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
2026-04-02 16:15:23 +02:00
devpts
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
dlm
ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs
2026-03-29 11:21:22 -07:00
ecryptfs
Merge tag 'ecryptfs-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs
2026-04-20 10:54:17 -07:00
efivarfs
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
efs
treewide: change inode->i_ino from unsigned long to u64
2026-03-06 14:31:28 +01:00
erofs
Merge tag 'erofs-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
2026-04-21 11:16:04 -07:00
exfat
Merge tag 'exfat-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat
2026-04-13 16:57:31 -07:00
exportfs
Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-04-21 07:30:44 -07:00
ext2
Merge tag 'fs_for_v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2026-04-15 19:22:16 -07:00
ext4
Merge tag 'ext4_for_linux-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
2026-04-17 17:08:31 -07:00
f2fs
Merge tag 'f2fs-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs
2026-04-21 14:50:04 -07:00
fat
Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:46:42 -07:00
freevxfs
treewide: change inode->i_ino from unsigned long to u64
2026-03-06 14:31:28 +01:00
fuse
fuse-uring: make a fuse_req on SQE commit only findable after memcpy
2026-06-15 14:06:14 +02:00
gfs2
Merge tag 'gfs2-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2
2026-04-15 19:12:04 -07:00
hfs
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
hfsplus
Merge tag 'hfs-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs
2026-04-13 16:50:38 -07:00
hostfs
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
hpfs
treewide: change inode->i_ino from unsigned long to u64
2026-03-06 14:31:28 +01:00
hugetlbfs
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
iomap
Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux
2026-04-13 17:29:12 -07:00
isofs
treewide: fix missed i_ino format specifier conversions
2026-03-06 14:31:30 +01:00
jbd2
Merge tag 'ext4_for_linux-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
2026-04-17 17:08:31 -07:00
jffs2
treewide: change inode->i_ino from unsigned long to u64
2026-03-06 14:31:28 +01:00
jfs
Merge tag 'jfs-7.1' of github.com:kleikamp/linux-shaggy
2026-04-15 19:29:18 -07:00
kernfs
Merge tag 'driver-core-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
2026-04-13 19:03:11 -07:00
lockd
Merge tag 'nfsd-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
2026-04-20 10:44:02 -07:00
minix
Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:46:42 -07:00
netfs
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
nfs
Merge tag 'nfs-for-7.1-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs
2026-04-24 14:20:03 -07:00
nfs_common
NFSD: Remove NFSERR_EAGAIN
2026-01-02 13:43:41 -05:00
nfsd
Merge tag 'nfsd-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
2026-04-20 10:44:02 -07:00
nilfs2
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
nls
fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
2025-12-01 11:58:06 +02:00
notify
Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-04-21 07:30:44 -07:00
ntfs
ntfs: use page allocation for resident attribute inline data
2026-04-22 19:05:07 +09:00
ntfs3
Merge tag 'ntfs3_for_7.1' of https://github.com/Paragon-Software-Group/linux-ntfs3
2026-04-20 10:59:47 -07:00
ocfs2
Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-04-21 07:30:44 -07:00
omfs
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
openpromfs
Coccinelle-based conversion to use ->i_state accessors
2025-10-20 20:22:26 +02:00
orangefs
Merge tag 'for-linus-7.1-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux
2026-04-17 17:03:43 -07:00
overlayfs
Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-04-21 07:30:44 -07:00
proc
Merge tag 'mm-nonmm-stable-2026-04-15-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-16 20:11:56 -07:00
pstore
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
qnx4
Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:46:42 -07:00
qnx6
Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:46:42 -07:00
quota
quota: Fix race of dquot_scan_active() with quota deactivation
2026-03-25 13:15:36 +01:00
ramfs
folio_batch: rename pagevec.h to folio_batch.h
2026-04-05 13:53:07 -07:00
resctrl
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
romfs
Merge tag 'mm-stable-2026-02-18-19-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-02-18 20:50:32 -08:00
smb
Merge tag 'v7.1-rc-part2-ksmbd-fixes' of git://git.samba.org/ksmbd
2026-04-23 17:04:18 -07:00
squashfs
Squashfs: check metadata block offset is within range
2026-02-24 11:13:27 -08:00
sysfs
Merge tag 'driver-core-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
2026-04-19 12:58:08 -07:00
tests
fs/tests: exec: Remove bad test vector
2026-03-18 11:41:53 -07:00
tracefs
Merge tag 'tracefs-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
2026-04-22 15:09:01 -07:00
ubifs
Merge tag 'mm-nonmm-stable-2026-04-15-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-16 20:11:56 -07:00
udf
Merge tag 'fs_for_v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2026-04-15 19:22:16 -07:00
ufs
Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:46:42 -07:00
unicode
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
vboxsf
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
verity
Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:19:01 -07:00
xfs
Merge tag 'xfs-merge-7.1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
2026-04-13 17:03:48 -07:00
zonefs
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
aio.c
fs: aio: reject partial mremap to avoid Null-pointer-dereference error
2026-04-24 00:34:59 +02:00
anon_inodes.c
anon_inodes: convert to FD_ADD()
2025-11-28 12:42:31 +01:00
attr.c
fs: attr: fix comment formatting and spelling issues
2026-04-07 11:26:11 +02:00
backing-file.c
lsm: add backing_file LSM hooks
2026-04-03 16:53:50 -04:00
bad_inode.c
fs: refactor ->update_time handling
2026-01-12 14:01:32 +01:00
binfmt_elf_fdpic.c
Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:19:01 -07:00
binfmt_elf.c
mm: unexport vm_brk_flags() and eliminate vm_flags parameter
2026-04-05 13:53:39 -07:00
binfmt_flat.c
…
binfmt_misc.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
binfmt_script.c
…
bpf_fs_kfuncs.c
bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs
2026-01-02 12:04:28 -08:00
buffer.c
Merge tag 'vfs-7.1-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-23 17:08:04 -07:00
char_dev.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
compat_binfmt_elf.c
…
coredump.c
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
d_path.c
dcache: permit dynamic_dname()s up to NAME_MAX
2026-04-07 12:32:22 +02:00
dax.c
Merge tag 'libnvdimm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2026-04-21 14:12:01 -07:00
dcache.c
Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-04-21 07:30:44 -07:00
direct-io.c
Merge tag 'mm-stable-2025-07-30-15-25' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-07-31 14:57:54 -07:00
drop_caches.c
Coccinelle-based conversion to use ->i_state accessors
2025-10-20 20:22:26 +02:00
eventfd.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
eventpoll.c
eventpoll: drop vestigial epi->dying flag
2026-04-24 00:37:01 +02:00
exec.c
exec: use strnlen() in __set_task_comm
2026-04-01 12:26:07 -07:00
fcntl.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
fhandle.c
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
file_attr.c
Merge tag 'vfs-7.0-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-02-25 10:34:23 -08:00
file_table.c
Merge tag 'lsm-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
2026-04-13 15:17:28 -07:00
file.c
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
filesystems.c
sysfs(2): fs_index() argument is _not_ a pathname
2026-01-16 12:52:04 -05:00
fs_context.c
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
fs_dirent.c
fs: rename fs_types.h to fs_dirent.h
2025-11-05 09:51:30 +01:00
fs_parser.c
fs: remove fsparam_path / fs_param_is_path
2026-02-19 14:34:26 +01:00
fs_pin.c
…
fs_struct.c
fs: add <linux/init_task.h> for 'init_fs'
2026-01-14 16:50:37 +01:00
fs-writeback.c
Merge tag 'vfs-7.1-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-23 17:08:04 -07:00
fserror.c
treewide: change inode->i_ino from unsigned long to u64
2026-03-06 14:31:28 +01:00
fsopen.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
init.c
Merge tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-02-09 16:58:28 -08:00
inode.c
Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-04-21 07:30:44 -07:00
internal.h
Merge tag 'lsm-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
2026-04-13 15:17:28 -07:00
ioctl.c
fs: remove vfs_ioctl export
2025-09-01 13:08:01 +02:00
Kconfig
ntfs: add Kconfig and Makefile
2026-02-19 21:51:00 +09:00
Kconfig.binfmt
binfmt_elf: preserve original ELF e_flags for core dumps
2025-09-03 20:49:32 -07:00
kernel_read_file.c
…
libfs.c
Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:46:42 -07:00
locks.c
Merge tag 'nfsd-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
2026-04-20 10:44:02 -07:00
Makefile
ntfs: add Kconfig and Makefile
2026-02-19 21:51:00 +09:00
mbcache.c
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
mnt_idmapping.c
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
mount.h
fs: add immutable rootfs
2026-01-12 16:52:09 +01:00
mpage.c
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
namei.c
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
namespace.c
mount: always duplicate mount
2026-04-14 09:30:15 +02:00
nsfs.c
Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:19:01 -07:00
nullfs.c
fs: add immutable rootfs
2026-01-12 16:52:09 +01:00
open.c
fs: remove do_sys_truncate
2026-03-23 12:41:58 +01:00
pidfs.c
Merge tag 'vfs-7.1-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 13:27:11 -07:00
pipe.c
treewide: change inode->i_ino from unsigned long to u64
2026-03-06 14:31:28 +01:00
pnode.c
umount_tree(): take all victims out of propagation graph at once
2025-09-15 21:26:44 -04:00
pnode.h
umount_tree(): take all victims out of propagation graph at once
2025-09-15 21:26:44 -04:00
posix_acl.c
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
proc_namespace.c
…
read_write.c
fs: add setlease to generic_ro_fops and read-only filesystem directory operations
2026-01-12 10:55:45 +01:00
readdir.c
fs: Replace user_access_{begin/end} by scoped user access
2026-03-24 14:44:02 +01:00
remap_range.c
…
select.c
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
seq_file.c
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
signalfd.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
splice.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
stack.c
…
stat.c
statx: switch to CLASS(filename_maybe_null)
2026-01-16 12:52:04 -05:00
statfs.c
user_statfs(): switch to CLASS(filename)
2026-01-16 12:52:04 -05:00
super.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
sync.c
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
sysctls.c
…
timerfd.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
userfaultfd.c
userfaultfd: allow registration of ranges below mmap_min_addr
2026-04-18 00:10:56 -07:00
utimes.c
do_utimes_path(): switch to CLASS(filename_uflags)
2026-01-16 12:52:03 -05:00
xattr.c
xattr: support extended attributes on sockets
2026-03-02 11:06:42 +01:00