[PATCH] fuse: acquire explicit folio refcount for readahead

[Joanne Koong <joannelkoong@xxxxxxxxx>]

In 3eab9d7bc2f4 ("fuse: convert readahead to use folios"), the logic
was converted to using the new folio readahead code, which drops the
reference on the folio once it is locked, using an inferred reference
on the folio. Previously we held a reference on the folio for the
entire duration of the readpages call.

This is fine, however for the case for splice pipe responses where we
will remove the old folio and splice in the new folio (see
fuse_try_move_page()), we assume that there is a reference held on the
folio for ap->folios, which is no longer the case.

To fix this and make the refcounting explicit, acquire a refcount on the
folio before we add it to ap->folios[] and drop it when we are done with
the folio in fuse_readpages_end(). This will fix the UAF bug that was
reported.

Link: https://lore.kernel.org/linux-fsdevel/2f681f48-00f5-4e09-8431-2b3dbfaa881e@xxxxxxxxx/
Fixes: 3eab9d7bc2f4 ("fuse: convert readahead to use folios")
Signed-off-by: Joanne Koong <joannelkoong@xxxxxxxxx>
---
 fs/fuse/file.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 7d92a5479998..6fa535c73d93 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -955,8 +955,10 @@ static void fuse_readpages_end(struct fuse_mount
*fm, struct fuse_args *args,
                fuse_invalidate_atime(inode);
        }

-       for (i = 0; i < ap->num_folios; i++)
+       for (i = 0; i < ap->num_folios; i++) {
                folio_end_read(ap->folios[i], !err);
+               folio_put(ap->folios[i]);
+       }
        if (ia->ff)
                fuse_file_put(ia->ff, false);

@@ -1049,6 +1051,12 @@ static void fuse_readahead(struct readahead_control *rac)

                while (ap->num_folios < cur_pages) {
                        folio = readahead_folio(rac);
+                       /*
+                        * Acquire an explicit reference on the folio in case
+                        * it's replaced in the page cache in the splice case
+                        * (see fuse_try_move_page()).
+                        */
+                       folio_get(folio);
                        ap->folios[ap->num_folios] = folio;
                        ap->descs[ap->num_folios].length = folio_size(folio);
                        ap->num_folios++;
--
2.43.5

> --
> Jeff Layton <jlayton@xxxxxxxxxx>