From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hpQ9K2h77z33C0 for ; Mon, 21 Sep 2026 14:10:13 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hpQ990N3Nz36Zl for ; Mon, 21 Sep 2026 14:10:05 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hpQ983dY4z5g0; Mon, 21 Sep 2026 14:10:04 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1789999804; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=G2I6iPiIjtfChk2QwWEg3dolPNIrrsy9ckQXTFK1GmQ=; b=9ghgQwj5gpGIX29a+irWXPg2JDl6Cr6EPFSXPIJbIFVT5L6w68x9BkJyvBRrYdrngVSwXk ZoBDq+HBvbttjFBA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1789999804; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=G2I6iPiIjtfChk2QwWEg3dolPNIrrsy9ckQXTFK1GmQ=; b=Qgu2nePJlWb11vjqRn9zGZVxJglo/Inbt9hXg5WNr9cZujANH+ODxlXpDJL/ctzq9HzG9G cVAmi2L5SL8iaQt8wK/auidCmVskbadIrjOykslDUz7Bc5Moy7tRa8FBdcuUd4TxjoOKsA hhNKUGTMUoYM2vH/tKdnOX24oq9opROOZQwpWl69OJOY6H/6Xvs80T8L2FH/3FyxXuBc60 7MBJntYyQoUI1CsEOXrhthhAJjeI1P2hrd1cm0TIJYqD++7rz0f7VEW3kZZm+amGrJsEir MIAK+Nc4hrZpwV//vpHIhPQcY8l+40oLNq+d4EnbB4QbkUNuY1KqtPw9oTk6sw== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] fuse: Update to version 3.18.3 Date: Mon, 21 Sep 2026 16:09:55 +0200 Message-ID: <20260921140958.515074-7-adolf.belka@ipfire.org> In-Reply-To: <20260921140958.515074-1-adolf.belka@ipfire.org> References: <20260921140958.515074-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit - Update from version 3.18.1 to 3.18.3 - Update of rootfile - Changelog 3.18.3 Security Fixes * ``fuse_session_custom_io()`` is disabled unless libfuse is built with ``-Denable-custom-io=true``, and returns ``-ENOTSUP`` otherwise. The ``hello_ll_uds`` example is built only with that option, and enabling it warns at configure time. Reason is a custom io peer might not be a kernel and can forge requests that libfuse parses without bounds checks, crashing or corrupting the filesystem process. See ``doc/README.custom-io``. * fusermount3: resolve the mountpoint once, through an ``O_PATH|O_NOFOLLOW`` descriptor. A symlink swapped in between the type check and the second lookup could redirect the mount. * fusermount3: run the auto-unmount probe as the calling user. It opened the caller-supplied mountpoint with elevated privileges before, so a symlink could get an attacker-chosen path opened as root. * mount_util: terminate the ``/bin/mount`` and ``/bin/umount`` argument vectors with ``--``. ``fsname`` reaches them straight from ``-ofsname=`` in setuid-root fusermount3, and the child raises the real uid to 0 before ``execle()``, so an unprivileged caller controlled a positional operand of a mount(8) that was not in restricted mode. * mount_util: skip the mtab update entirely for option-like mount arguments. BusyBox mount(8) does not honour ``--``. * fusermount3: unmount through ``unmount_fuse()`` when passing the device descriptor to the caller fails, so that path drops privileges and runs the ``fusermount3 -u`` checks instead of calling ``umount2()`` as root on a caller-supplied path. * fusermount3 and lib: pass ``UMOUNT_NOFOLLOW`` on the kernel and non-setuid unmount paths. * fusermount3: check the ``fstat()`` return value when validating the communication file descriptor. * fusermount3: fix an out-of-bounds read at index -1 in ``get_mnt_opts()`` when the option string is empty, which a read-only mount with no further options reaches. * util: avoid a pointer underflow when trimming ``fuse.conf`` lines. * fusermount3: reject a negative ``mount_max`` other than the documented -1. A typo such as -2 made the limit comparison always true and blocked every non-root mount. * lib: relay the KILLPRIV_V2 kill-suidgid flags to the filesystem in the new ``fuse_file_info::kill_suidgid``. Only ``setattr`` saw them before, so a filesystem that had taken over clearing suid/sgid never learned of it on ``O_TRUNC`` open and on write, and the bits survived. Note: ``fuse_file_info::kill_suidgid`` is new in 3.18.3 and ``FUSE_VERSION`` carries no patch level. A filesystem built against these headers but running against an older 3.18 library finds the field permanently zero, so require 3.18.3 at run time as well. Important Fixes * Fixed a hang on ``statx`` in builds without ``HAVE_STATX``: ``_do_statx()`` never replied, so the kernel waited forever. * io-uring: the CQE dispatch validated the opcode against ``fuse_ll_ops[]`` but called through ``fuse_ll_ops2[]``, so an opcode with no handler there was called as a null function pointer. * io-uring: fixed the notify-retrieve reply buffer handling. The ``fuse_notify_retrieve_in`` header sits at the start of the payload buffer, not in the ring header. * io-uring: fixed the ``req_header_sz`` calculation, which sized the header buffer from the wrong struct. * io-uring: create the rings with ``IORING_SETUP_SUBMIT_ALL``, so one failing commit SQE no longer leaves the rest of the batch unsubmitted. * io-uring: ``fuse_reply_none()`` commits the ring entry. A FORGET answered that way leaked the entry and left the kernel-side request outstanding. * fusermount3: treat ``ECONNABORTED`` like ``ENOTCONN`` when deciding whether to auto-unmount, so a daemon that dies with io-uring registered no longer leaves the mount behind. * ``receive_fd()``: check ``CMSG_FIRSTHDR()`` for NULL before dereferencing it. * ``fuse_session_loop_mt_312()`` no longer destroys ``se->mt_lock`` before ``fuse_session_destroy()`` destroys it again, which was undefined behaviour on every multi-threaded shutdown. * ``fuse_loop_cfg_create()`` returning NULL is checked before the config is dereferenced in ``fuse_session_loop_mt_312()`` and ``fuse_session_loop_mt_31()``. * iconv: the error check after opening the ``fromfs`` descriptor tested ``tofs``, so a failed ``iconv_open()`` was ignored and left an invalid descriptor behind. * mount.fuse: a failure to clear ``FD_CLOEXEC`` went undetected, because the result was compared against 1 rather than -1. * ``grow_pipe_to_max()`` opens ``/proc/sys/fs/pipe-max-size`` with ``O_CLOEXEC``; a concurrent fork+exec leaked the descriptor into the child. * Fixed a build failure for ``FUSE_USE_VERSION`` 312 and newer without symbol versioning, where ``fuse_loop_mt()`` expanded to an undeclared ``fuse_loop_mt_312()``. * Fixed a Clang 21 build failure in ``ST_MTIM_NSEC``. * Fixed leaks: the pipe when its size cannot be grown, the mountpoint in ``fuse_session_mount()`` and ``fuse_session_destroy()``, the pipe descriptors when ``fork()`` or ``setsid()`` fail in ``fuse_daemonize()``, the context when ``pthread_setspecific()`` fails, ``print_module_help()``, and a ``fuse_pollhandle`` in ``fuse_lib_poll()``. * Examples: ``update_fs()`` uses ``localtime_r()``. ``localtime()`` returns a shared static ``struct tm``, so it raced with the session threads and ``strftime()`` could format a half-overwritten time. * Examples: ``cuse_client`` caps the transfer size at 16 MiB. ``do_rw()`` passed the SIZE argument straight to ``calloc()``. * Examples: memfs_ll locking, refcounting and bounds fixes, including a use-after-free on rename overwrite and on a concurrent forget. * Examples: passthrough_hp lock-order and lifetime fixes. The directory stream is protected by a per-handle lock, ``fs.mutex`` is taken before ``Inode::m`` and when ``link()`` raises nlookup, and no inode lock is held across a syscall or a reply. Documentation * The fuse-devel mailing list moved to lists.linux.dev. * Man page and README corrections. 3.18.2 * Fix two io-uring issues that might be security critical * fuse-io-uring: Fix UAF and NULL deref in startup error path * fuse-io-uring: Fix NULL deref and memory leak in fuse_uring_init_queue Signed-off-by: Adolf Belka --- config/rootfiles/common/fuse | 2 +- lfs/fuse | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/fuse b/config/rootfiles/common/fuse index db16cea63..19f90b618 100644 --- a/config/rootfiles/common/fuse +++ b/config/rootfiles/common/fuse @@ -11,7 +11,7 @@ usr/bin/fusermount3 #usr/include/fuse3/fuse_opt.h #usr/include/fuse3/libfuse_config.h #usr/lib/libfuse3.so -usr/lib/libfuse3.so.3.18.1 +usr/lib/libfuse3.so.3.18.3 usr/lib/libfuse3.so.4 #usr/lib/pkgconfig/fuse3.pc usr/lib/udev/rules.d/99-fuse3.rules diff --git a/lfs/fuse b/lfs/fuse index aa6e3103c..cb393f06d 100644 --- a/lfs/fuse +++ b/lfs/fuse @@ -24,7 +24,7 @@ include Config -VER = 3.18.1 +VER = 3.18.3 THISAPP = fuse-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = b0a38794b8eb932f7b23314afdaeacbdd302e9f9037794f5dceb87b22f19de8d125ec0112ee28751b94063324c872e03c26e3128c6cd817858245f7df5acd7ef +$(DL_FILE)_BLAKE2 = d6d1312484bce853b8ad3df2be9ddc4fb9be237948cac48f4d76c1a303d2cc7dcc2c98faf1ca51093d663512040f12cd73376ec92e3f6974eaf0206f853abea3 install : $(TARGET) -- 2.55.0