fuse: Fix GID when sending FUSE_INTERRUPT to a FUSE daemon
Due to the partial-only changes of commit46c07316f9("kern: adopt the cr_gid macro for cr_groups[0] more widely"), subsequent commitbe1f7435ef("kern: start tracking cr_gid outside of cr_groups[]") caused a mismatch between filling cr_groups[0] in 'reused_creds' in fuse_interrupt_send() and reading 'cr_gid' from it in fuse_setup_ihead(), with the consequence that the kernel would send a FUSE_INTERRUPT message to the FUSE deamon with an uninitialized GID in its header (which, besides being wrong, would disclose 4 bytes from its stack). Fixes:be1f7435ef("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52255
This commit is contained in:
@@ -193,7 +193,6 @@ fuse_interrupt_send(struct fuse_ticket *otick, int err)
|
||||
struct fuse_data *data = otick->tk_data;
|
||||
struct fuse_ticket *tick, *xtick;
|
||||
struct ucred reused_creds;
|
||||
gid_t reused_groups[1];
|
||||
|
||||
if (otick->irq_unique == 0) {
|
||||
/*
|
||||
@@ -237,8 +236,7 @@ fuse_interrupt_send(struct fuse_ticket *otick, int err)
|
||||
*/
|
||||
ftick_hdr = fticket_in_header(otick);
|
||||
reused_creds.cr_uid = ftick_hdr->uid;
|
||||
reused_groups[0] = ftick_hdr->gid;
|
||||
reused_creds.cr_groups = reused_groups;
|
||||
reused_creds.cr_gid = ftick_hdr->gid;
|
||||
fdisp_init(&fdi, sizeof(*fii));
|
||||
fdisp_make_pid(&fdi, FUSE_INTERRUPT, data, ftick_hdr->nodeid,
|
||||
ftick_hdr->pid, &reused_creds);
|
||||
|
||||
Reference in New Issue
Block a user