diff options
author | Miklos Szeredi <mszeredi@redhat.com> | 2018-05-31 12:26:10 +0200 |
---|---|---|
committer | Miklos Szeredi <mszeredi@redhat.com> | 2018-05-31 12:26:10 +0200 |
commit | 6becdb601bae2a043d7fb9762c4d48699528ea6e (patch) | |
tree | 7d136a357c374a82bb8e329811d84af96a920a36 /.mailmap | |
parent | 8a301eb16d99983a4961f884690ec97b92e7dcfe (diff) | |
download | linux-6becdb601bae2a043d7fb9762c4d48699528ea6e.tar.bz2 |
fuse: fix control dir setup and teardown
syzbot is reporting NULL pointer dereference at fuse_ctl_remove_conn() [1].
Since fc->ctl_ndents is incremented by fuse_ctl_add_conn() when new_inode()
failed, fuse_ctl_remove_conn() reaches an inode-less dentry and tries to
clear d_inode(dentry)->i_private field.
Fix by only adding the dentry to the array after being fully set up.
When tearing down the control directory, do d_invalidate() on it to get rid
of any mounts that might have been added.
[1] https://syzkaller.appspot.com/bug?id=f396d863067238959c91c0b7cfc10b163638cac6
Reported-by: syzbot <syzbot+32c236387d66c4516827@syzkaller.appspotmail.com>
Fixes: bafa96541b25 ("[PATCH] fuse: add control filesystem")
Cc: <stable@vger.kernel.org> # v2.6.18
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Diffstat (limited to '.mailmap')
0 files changed, 0 insertions, 0 deletions