fuse: fix control dir setup and teardown (6becdb60) · Commits · 戴 / test

syzbot is reporting NULL pointer dereference at fuse_ctl_remove_conn() [1]. Since fc->ctl_ndents is incremented by fuse_ctl_add_conn() when new_inode() failed, fuse_ctl_remove_conn() reaches an inode-less dentry and tries to clear d_inode(dentry)->i_private field. Fix by only adding the dentry to the array after being fully set up. When tearing down the control directory, do d_invalidate() on it to get rid of any mounts that might have been added. [1] https://syzkaller.appspot.com/bug?id=f396d863067238959c91c0b7cfc10b163638cac6 Reported-by:

syzbot <syzbot+32c236387d66c4516827@syzkaller.appspotmail.com> Fixes: ("[PATCH] fuse: add control filesystem") Cc: <stable@vger.kernel.org> # v2.6.18 Signed-off-by:

Miklos Szeredi <mszeredi@redhat.com>

fs/fuse/control.c

+10 −3

Original line number	Diff line number	Diff line
		@@ -211,10 +211,11 @@ static struct dentry fuse_ctl_add_dentry(struct dentry parent,
		if (!dentry)
		return NULL;

		fc->ctl_dentry[fc->ctl_ndents++] = dentry;
		inode = new_inode(fuse_control_sb);
		if (!inode)
		if (!inode) {
		dput(dentry);
		return NULL;
		}

		inode->i_ino = get_next_ino();
		inode->i_mode = mode;
		@@ -228,6 +229,9 @@ static struct dentry fuse_ctl_add_dentry(struct dentry parent,
		set_nlink(inode, nlink);
		inode->i_private = fc;
		d_add(dentry, inode);

		fc->ctl_dentry[fc->ctl_ndents++] = dentry;

		return dentry;
		}

		@@ -284,7 +288,10 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc)
		for (i = fc->ctl_ndents - 1; i >= 0; i--) {
		struct dentry *dentry = fc->ctl_dentry[i];
		d_inode(dentry)->i_private = NULL;
		d_drop(dentry);
		if (!i) {
		/* Get rid of submounts: */
		d_invalidate(dentry);
		}
		dput(dentry);
		}
		drop_nlink(d_inode(fuse_control_sb->s_root));

Admin message