Fix premature free() in sftp_readdir_async()

This commit is contained in:
Andrew Lukoshko 2026-04-20 22:28:47 +00:00 committed by root
parent 7512540885
commit 5311bd1fab
2 changed files with 44 additions and 1 deletions

View File

@ -0,0 +1,34 @@
diff -ur sshfs-2.8.old/ChangeLog sshfs-2.8/ChangeLog
--- sshfs-2.8.old/ChangeLog 2016-06-22 19:38:01.000000000 +0100
+++ sshfs-2.8/ChangeLog 2021-09-07 08:17:35.352080786 +0100
@@ -1,3 +1,9 @@
+ Unreleased Changes
+ ------------------
+
++* Fixed a crash due to a race condition when listing
++ directory contents.
+
Release 2.7 (2016-06-22)
------------------------
diff -ur sshfs-2.8.old/sshfs.c sshfs-2.8/sshfs.c
--- sshfs-2.8.old/sshfs.c 2016-06-08 16:42:12.000000000 +0100
+++ sshfs-2.8/sshfs.c 2021-09-07 08:17:06.339682726 +0100
@@ -2173,11 +2173,16 @@
outstanding--;
if (done) {
+ /* We need to cache want_reply, since processing
+ thread may free req right after unlock() if
+ want_reply == 0 */
+ int want_reply;
pthread_mutex_lock(&sshfs.lock);
if (sshfs_req_pending(req))
req->want_reply = 0;
+ want_reply = req->want_reply;
pthread_mutex_unlock(&sshfs.lock);
- if (!req->want_reply)
+ if (!want_reply)
continue;
}

View File

@ -3,13 +3,16 @@
Name: fuse-sshfs
Version: 2.8
Release: 5%{?dist}
Release: 5%{?dist}.alma.1
Summary: FUSE-Filesystem to access remote filesystems via SSH
Group: System Environment/Base
License: GPLv2
URL: https://github.com/libfuse/sshfs
Source0: https://github.com/libfuse/sshfs/releases/download/sshfs_%{version}/sshfs-%{version}.tar.gz
Source1: https://github.com/libfuse/sshfs/releases/download/sshfs_%{version}/sshfs-%{version}.tar.gz.asc
# AlmaLinux Patch
Patch1000: 1000-sshfs-fix-premature-free.patch
Provides: sshfs = %{version}-%{release}
Requires: fuse >= 2.2
Requires: openssh-clients
@ -28,6 +31,9 @@ mounting the filesystem is as easy as logging into the server with ssh.
%prep
%setup -q -n sshfs-%{version}
# Applying AlmaLinux Patch
%patch -P 1000 -p1 -b .1000-sshfs-fix-premature-free
%build
%configure
@ -46,6 +52,9 @@ make install DESTDIR=%{buildroot}
%changelog
* Mon Apr 20 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 2.8-5.alma.1
- Fix premature free() in sftp_readdir_async()
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild