In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fuse: fix invalidate lock leak on setattr writeback failure<\/p>\n
fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate
\n(fault_blocked = true) and releases it at the out:\/error: labels. But
\nwhen a writeback flush is also needed, a write_inode_now() failure
\nreturns directly and leaks the lock, so any later fault or truncate on
\nthe file stalls on the stale rwsem.<\/p>\n
For example, truncate(2) on a setuid file reaches fuse_do_setattr()
\nwith both ATTR_SIZE and ATTR_MODE set:<\/p>\n
truncate(2)
\n \u2514\u2500 do_truncate()
\n \u251c\u2500 dentry_needs_remove_privs() # S_ISUID
\n \u2514\u2500 notify_change() # KILL_SUID -> ATTR_MODE
\n \u2514\u2500 fuse_setattr() # no killpriv:
\n \u2502 # ia_valid |= ATTR_MODE
\n \u2514\u2500 fuse_do_setattr()
\n \u251c\u2500 filemap_invalidate_lock() # IS_DAX && is_truncate
\n \u2514\u2500 write_inode_now() # is_wb && ATTR_MODE
\n \u2514\u2500 if (err) # e.g. daemon -> -EIO
\n return err # <- lock leaked<\/p>\n
Fix this by adding an unlock label that releases the lock before
\nreturning the error, and use it for the fuse_dax_break_layouts()
\nfailure path as well.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fuse: fix invalidate lock leak on setattr writeback failure<\/p>\n
fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate
\n(<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17360","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17360","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17360"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17360"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17360"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}