Files
linux/include/linux
David Howells dbe5569721 netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it
is wanting to unlock and compares that to rreq->no_unlock_folio so that it
doesn't unlock a folio being read for netfs_perform_write() or
netfs_write_begin().

However, given that netfs_unlock_abandoned_read_pages() is called _after_
NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to
dereference is the one specified by ->no_unlock_folio as ownership
immediately reverts to the caller.

Fix this by storing the folio pointer instead and using that rather than
the index.  Also fix netfs_unlock_read_folio() where the same applies.

Fixes: ee4cdf7ba8 ("netfs: Speed up buffered reading")
Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260512123404.719402-20-dhowells@redhat.com
cc: Paulo Alcantara <pc@manguebit.org>
cc: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
cc: Matthew Wilcox <willy@infradead.org>
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-05-12 14:42:32 +02:00
..
2026-02-11 13:44:47 +01:00
2026-04-02 15:52:49 +02:00
2026-03-18 15:11:40 +05:30
2026-03-19 23:55:27 +01:00
2026-04-03 16:53:50 -04:00
2026-04-07 08:22:24 -06:00
2026-04-22 12:58:57 -07:00
2026-04-04 08:10:37 -06:00
2026-03-16 13:16:49 +01:00
2026-03-02 17:08:05 -05:00
2026-03-31 19:15:21 +02:00
2026-04-16 07:03:40 -07:00
2026-03-23 13:33:51 -04:00
2026-04-07 17:38:07 +02:00
2026-02-19 09:12:05 +01:00
2026-02-27 16:40:16 +01:00
2026-02-23 13:43:16 -08:00
2026-02-06 07:29:14 -07:00
2026-04-05 13:53:28 -07:00
2026-04-01 10:19:41 +02:00
2026-04-03 16:53:50 -04:00
2026-04-03 16:53:50 -04:00
2026-03-18 09:59:57 +00:00
2026-04-06 11:39:54 +02:00
2026-04-05 13:53:00 -07:00
2026-03-17 15:34:47 +05:30
2026-03-08 11:06:53 +01:00
2026-03-27 07:35:05 -07:00
2026-04-05 13:53:10 -07:00
2026-02-10 11:39:31 +01:00
2026-02-10 11:39:30 +01:00
2026-04-20 11:35:17 -07:00
2026-03-27 17:14:31 -07:00
2026-02-27 16:40:16 +01:00
2026-03-08 11:06:53 +01:00
2026-03-31 07:04:00 -06:00
2026-03-25 20:11:29 +01:00
2026-03-23 12:41:58 +01:00
2026-03-13 08:22:54 +01:00
2026-03-12 15:05:34 +01:00
2026-04-13 08:39:51 -07:00
2026-04-06 09:06:39 +02:00
2026-03-30 16:43:24 -06:00