diff options
author | Miklos Szeredi <mszeredi@redhat.com> | 2021-10-21 10:01:39 +0200 |
---|---|---|
committer | Miklos Szeredi <mszeredi@redhat.com> | 2021-10-21 10:01:39 +0200 |
commit | 80019f1138324b6f35ae728b4f25eeb08899b452 (patch) | |
tree | 3a6508d79d7938ac7be3a6b6c35d9ff2d1fec14c /samples | |
parent | c191cd07ee948c93081d8e4cba43d23b18b2f3da (diff) | |
download | linux-80019f1138324b6f35ae728b4f25eeb08899b452.tar.gz linux-80019f1138324b6f35ae728b4f25eeb08899b452.tar.bz2 linux-80019f1138324b6f35ae728b4f25eeb08899b452.zip |
fuse: always initialize sb->s_fs_info
Syzkaller reports a null pointer dereference in fuse_test_super() that is
caused by sb->s_fs_info being NULL.
This is due to the fact that fuse_fill_super() is initializing s_fs_info,
which is too late, it's already on the fs_supers list. The initialization
needs to be done in sget_fc() with the sb_lock held.
Move allocation of fuse_mount and fuse_conn from fuse_fill_super() into
fuse_get_tree().
After this ->kill_sb() will always be called with non-NULL ->s_fs_info,
hence fuse_mount_destroy() can drop the test for non-NULL "fm".
Reported-by: syzbot+74a15f02ccb51f398601@syzkaller.appspotmail.com
Fixes: 5d5b74aa9c76 ("fuse: allow sharing existing sb")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Diffstat (limited to 'samples')
0 files changed, 0 insertions, 0 deletions