mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
fuse: Fix crash in fuse_dentry_automount() error path
If fuse_fill_super_submount() returns an error, the error path
triggers a crash:
[ 26.206673] BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
[ 26.226362] RIP: 0010:__list_del_entry_valid+0x25/0x90
[...]
[ 26.247938] Call Trace:
[ 26.248300] fuse_mount_remove+0x2c/0x70 [fuse]
[ 26.248892] virtio_kill_sb+0x22/0x160 [virtiofs]
[ 26.249487] deactivate_locked_super+0x36/0xa0
[ 26.250077] fuse_dentry_automount+0x178/0x1a0 [fuse]
The crash happens because fuse_mount_remove() assumes that the FUSE
mount was already added to list under the FUSE connection, but this
only done after fuse_fill_super_submount() has returned success.
This means that until fuse_fill_super_submount() has returned success,
the FUSE mount isn't actually owned by the superblock. We should thus
reclaim ownership by clearing sb->s_fs_info, which will skip the call
to fuse_mount_remove(), and perform rollback, like virtio_fs_get_tree()
already does for the root sb.
Fixes: bf109c6404
("fuse: implement crossmounts")
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
This commit is contained in:
parent
614124bea7
commit
d92d88f056
1 changed files with 5 additions and 1 deletions
|
@ -339,8 +339,12 @@ static struct vfsmount *fuse_dentry_automount(struct path *path)
|
|||
|
||||
/* Initialize superblock, making @mp_fi its root */
|
||||
err = fuse_fill_super_submount(sb, mp_fi);
|
||||
if (err)
|
||||
if (err) {
|
||||
fuse_conn_put(fc);
|
||||
kfree(fm);
|
||||
sb->s_fs_info = NULL;
|
||||
goto out_put_sb;
|
||||
}
|
||||
|
||||
sb->s_flags |= SB_ACTIVE;
|
||||
fsc->root = dget(sb->s_root);
|
||||
|
|
Loading…
Reference in a new issue