From 05b510bb893761864d3830eb781210445056a6f9 Mon Sep 17 00:00:00 2001 From: Pranith Kumar K Date: Sun, 6 Dec 2015 22:05:54 +0530 Subject: mount/fuse: Fix use-after-free crash fouh->len is accessed after 'node' is freed. Also 'rv' is int where as fouh->len is uint32, changed comparison to ssize_t variables. BUG: 1288857 Change-Id: Ied43d29e1e52719f9b52fe839cee31ce65711eea Signed-off-by: Pranith Kumar K Reviewed-on: http://review.gluster.org/12886 Tested-by: Gluster Build System Reviewed-by: Raghavendra G --- xlators/mount/fuse/src/fuse-bridge.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'xlators') diff --git a/xlators/mount/fuse/src/fuse-bridge.c b/xlators/mount/fuse/src/fuse-bridge.c index 16dd5b5ea0d..dc4b934e97b 100644 --- a/xlators/mount/fuse/src/fuse-bridge.c +++ b/xlators/mount/fuse/src/fuse-bridge.c @@ -3842,7 +3842,8 @@ notify_kernel_loop (void *data) xlator_t *this = NULL; fuse_private_t *priv = NULL; struct fuse_out_header *fouh = NULL; - int rv = 0; + ssize_t rv = 0; + ssize_t len = 0; fuse_invalidate_node_t *node = NULL; this = data; @@ -3868,17 +3869,19 @@ notify_kernel_loop (void *data) fouh = (struct fuse_out_header *)node->inval_buf; + len = fouh->len; rv = sys_write (priv->fd, node->inval_buf, fouh->len); - GF_FREE (node); - if (rv != fouh->len && !(rv == -1 && errno == ENOENT)) + if (rv != len && !(rv == -1 && errno == ENOENT)) break; + GF_FREE (node); } gf_log ("glusterfs-fuse", GF_LOG_INFO, "kernel notifier loop terminated"); + GF_FREE (node); return NULL; } #endif -- cgit