[Bug 259071] Read past EoF in NFS client and fusefs

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259071

--- Comment #22 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=13d593a5b060cf7be40acfa2ca9dc9e0e2339a31

commit 13d593a5b060cf7be40acfa2ca9dc9e0e2339a31
Author:     Alan Somers <asomers@FreeBSD.org>
AuthorDate: 2021-11-29 02:17:34 +0000
Commit:     Alan Somers <asomers@FreeBSD.org>
CommitDate: 2022-01-01 00:38:42 +0000

    Fix a race in fusefs that can corrupt a file's size.

    VOPs like VOP_SETATTR can change a file's size, with the vnode
    exclusively locked.  But VOPs like VOP_LOOKUP look up the file size from
    the server without the vnode locked.  So a race is possible.  For
    example:

    1) One thread calls VOP_SETATTR to truncate a file.  It locks the vnode
       and sends FUSE_SETATTR to the server.
    2) A second thread calls VOP_LOOKUP and fetches the file's attributes from
       the server.  Then it blocks trying to acquire the vnode lock.
    3) FUSE_SETATTR returns and the first thread releases the vnode lock.
    4) The second thread acquires the vnode lock and caches the file's
       attributes, which are now out-of-date.

    Fix this race by recording a timestamp in the vnode of the last time
    that its filesize was modified.  Check that timestamp during VOP_LOOKUP
    and VFS_VGET.  If it's newer than the time at which FUSE_LOOKUP was
    issued to the server, ignore the attributes returned by FUSE_LOOKUP.

    PR:             259071
    Reported by:    Agata <chogata@moosefs.pro>
    Reviewed by:    pfg
    MFC after:      2 weeks
    Differential Revision: https://reviews.freebsd.org/D33158

 sys/fs/fuse/fuse_internal.c                    |   5 +
 sys/fs/fuse/fuse_io.c                          |   5 +-
 sys/fs/fuse/fuse_node.c                        |   5 +-
 sys/fs/fuse/fuse_node.h                        |   6 +
 sys/fs/fuse/fuse_vfsops.c                      |  13 +-
 sys/fs/fuse/fuse_vnops.c                       |  21 +-
 tests/sys/fs/fusefs/Makefile                   |   1 +
 tests/sys/fs/fusefs/last_local_modify.cc (new) | 469 +++++++++++++++++++++++++
 8 files changed, 516 insertions(+), 9 deletions(-)

-- 
You are receiving this mail because:
You are the assignee for the bug.