github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fuse: validate folio state before pipe_buf_try_steal() in fuse_try_move_folio()

Browse Source 
In fuse_try_move_folio(), check that the pipe buffer's folio is not
hugetlb, swap-backed, or already mapped/anon before attempting
pipe_buf_try_steal() and inserting it into the FUSE inode's page cache,
preventing VM_BUG_ON_FOLIO() and page cache state corruption.

Fixes: 394244b24f ("fuse: support copying large folios")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
This commit is contained in:
Hui Peng 2026-09-19 22:17:33 +00:00 committed by Miklos Szeredi
parent bcd3a16ae7
commit 15c20483d9
1 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
fs/fuse/dev.c
View File

@ -1151,32 +1151,32 @@ static int fuse_try_move_folio(struct fuse_copy_state *cs, struct folio **foliop
if (cs->len != folio_size(oldfolio))
goto out_fallback;
if (!pipe_buf_try_steal(cs->pipe, buf))
goto out_fallback;
newfolio = page_folio(buf->page);
folio_clear_uptodate(newfolio);
folio_clear_mappedtodisk(newfolio);
if (folio_test_large(newfolio))
goto out_fallback_unlock;
if (fuse_check_folio(newfolio) != 0)
goto out_fallback_unlock;
goto out_fallback;
/*
* This is a new and locked page, it shouldn't be mapped or
* have any special flags on it
*/
if (WARN_ON(folio_mapped(oldfolio)))
goto out_fallback_unlock;
goto out_fallback;
if (WARN_ON(folio_has_private(oldfolio)))
goto out_fallback_unlock;
goto out_fallback;
if (WARN_ON(folio_test_dirty(oldfolio) ||
folio_test_writeback(oldfolio)))
goto out_fallback_unlock;
goto out_fallback;
if (WARN_ON(folio_test_mlocked(oldfolio)))
goto out_fallback;
if (!pipe_buf_try_steal(cs->pipe, buf))
goto out_fallback;
folio_clear_uptodate(newfolio);
folio_clear_mappedtodisk(newfolio);
if (fuse_check_folio(newfolio) != 0)
goto out_fallback_unlock;
err = lock_request(cs->req);