| commit | f38de0b09885b8766de2b351d90cc86ce7d9240c | [log] [tgz] |
|---|---|---|
| author | Zim <zezeozue@google.com> | Thu Aug 05 15:29:02 2021 +0100 |
| committer | Zim <zezeozue@google.com> | Thu Aug 05 15:29:02 2021 +0100 |
| tree | b0a40b24e9c801236b0b658993ad1213d1ebd1ad | |
| parent | 369f9c88158f0a07ed9be067a8ba8deba8659cca [diff] |
Fix use-after-free bug in FuseDaemon The FuseDaemon periodically runs fadvise on the lower file system to avoid double caching. As part of 'recording' the write for the fadvise queue we sometimes raced and had the following ordering of events: T1: fuse_reply_write T2: pf_release (destroy handle) T1: Record (using already destroyed handle) Now we, call Record before fuse_reply_write Test: Manual Bug: 192085766 Bug: 195615818 Change-Id: Iba7598d40aa03d082af10935552ac7db7e28c5b6