On Sat, Apr 28, 2018 at 4:29 AM, Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> wrote: > From 9f41081f8bd6762a6f629e5e23e6d07a62bba69c Mon Sep 17 00:00:00 2001 > From: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> > Date: Sat, 28 Apr 2018 11:24:09 +0900 > Subject: [PATCH] fuse: don't keep inode-less dentry at fuse_ctl_add_dentry(). > > syzbot is reporting NULL pointer dereference at fuse_ctl_remove_conn() [1]. > Since fc->ctl_ndents is incremented by fuse_ctl_add_conn() when new_inode() > failed, fuse_ctl_remove_conn() reaches an inode-less dentry and tries to > clear d_inode(dentry)->i_private field. Fix this by calling dput() rather > than incrementing fc->ctl_ndents when new_inode() failed. > > [1] https://syzkaller.appspot.com/bug?id=f396d863067238959c91c0b7cfc10b163638cac6 Slightly different fix pushed to: git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git for-next Thanks, Miklos
