In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fuse: invalidate the correct range after O_APPEND direct write<\/p>\n
fuse_direct_write_iter() captures pos before generic_write_checks(),
\nwhich moves ki_pos to EOF for O_APPEND writes:<\/p>\n
fuse_direct_write_iter()
\n {
\n pos = iocb->ki_pos; \/* 0 (user-supplied) *\/
\n generic_write_checks(); \/* ki_pos -> EOF *\/
\n fuse_direct_io(); \/* writes at EOF, correct *\/
\n invalidate(pos, pos + res); \/* [0, res) — wrong *\/
\n }<\/p>\n
The post-write invalidation targets a stale range instead of the
\nactual written range at EOF.<\/p>\n
This can cause data inconsistency when the file size is not
\npage-aligned. The tail page straddling EOF has a valid portion
\nbefore EOF that concurrent readers can fault back in during the
\nDIO write window:<\/p>\n
Tail page (file size X not page-aligned):<\/p>\n
page_start X (EOF) page_end
\n |— valid data —-|– stale –|<\/p>\n
CPU0 (O_APPEND DIO writer) CPU1 (buffered reader)
\n ————————– ———————-
\n invalidate [X, X+len)
\n tail page evicted
\n FUSE_WRITE in flight …
\n read [page_start, X)
\n tail page re-faulted
\n [X, page_end) = stale
\n FUSE_WRITE completes
\n i_size = X + len
\n invalidate [0, len) ki_pos after generic_write_checks(),
\nas generic_file_direct_write() does.<\/p>\n
Also fix a typo in the comment (“may have” -> “may have competed”).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fuse: invalidate the correct range after O_APPEND direct write<\/p>\n
fuse_direct_write_iter() captures pos before generic_write_checks()<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25505","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}