Skip to contentSkip to conversation

fuse: Initialize the flock flag in the fuse_file structure upon allocation

PATCH In review Mateusz Jurczyk 2 participants 2 messages Jun 7, 2017 – Jun 9, 2017

Subsystems (2)
VFS FUSE filesystem core
lore
Share & tools
lore

Mateusz Jurczyk

author
#0 lore raw

PATCH 1/1 fuse: Initialize the flock flag in the fuse_file structure upon allocation

Add initialization of the flock flag in the fuse_file structure after it is allocated.

Before the patch, the flock flag could remain uninitialized for the lifespan of the fuse_file allocation: it was not pre-set by kmalloc() or later in the fuse_file_alloc() function. Unless set to true in fuse_file_flock(), it would remain in an indeterminate state until read in an if statement in fuse_release_common(). This could consequently lead to taking an unexpected branch in the code.

The bug was discovered by a runtime instrumentation designed to detect use of uninitialized memory in the kernel.

Signed-off-by Mateusz Jurczyk <[email protected]>
---
 fs/fuse/file.c | 2 ++
 1 file changed, 2 insertions(+)
fs/fuse/file.c +2 -0
index 3ee4fdc3da9e..c9a86a748ceb 100644
@@ -66,6 +66,8 @@ struct fuse_file *fuse_file_alloc(struct fuse_conn *fc)
 	ff->kh = ++fc->khctr;
 	spin_unlock(&fc->lock);
 
+	ff->flock = false;
+
 	return ff;
 }
Signature · 1 line
2.13.1.508.gb3defc5cc-goog
maintainer
#1 lore raw
Quoted 10 lines · Mateusz Jurczyk

Add initialization of the flock flag in the fuse_file structure after it is allocated.

Before the patch, the flock flag could remain uninitialized for the lifespan of the fuse_file allocation: it was not pre-set by kmalloc() or later in the fuse_file_alloc() function. Unless set to true in fuse_file_flock(), it would remain in an indeterminate state until read in an if statement in fuse_release_common(). This could consequently lead to taking an unexpected branch in the code.

Quoted 4 lines

The bug was discovered by a runtime instrumentation designed to detect use of uninitialized memory in the kernel.

Signed-off-by Mateusz Jurczyk <[email protected]>

Thanks for spotting this. Pushed a modified version (kzalloc instead
of explicit init) to the fuse git tree.

Thanks,
Miklos

Quoted 20 lines
---
 fs/fuse/file.c | 2 ++
 1 file changed, 2 insertions(+)
fs/fuse/file.c +2 -1
index 3ee4fdc3da9e..c9a86a748ceb 100644
@@ -66,6 +66,8 @@ struct fuse_file *fuse_file_alloc(struct fuse_conn *fc)
        ff->kh = ++fc->khctr;
        spin_unlock(&fc->lock);
 
+       ff->flock = false;
+
        return ff;
 }
 
--

2.13.1.508.gb3defc5cc-goog