virtiofs device implementations are allowed to provide more than one
request queue. In this case `fsvq->fud` would not be initialized,
leading to a nullptr dereference later during driver initialization.
Make sure that `fsvq->fud` is initialized for all request queues even if
the driver doesn't use them.
Signed-off-by: Chirantan Ekbote <chirantan@xxxxxxxxxxxx>
---
fs/fuse/virtio_fs.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index bade747689033..d3c38222a7e4e 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -1066,10 +1066,13 @@ static int virtio_fs_fill_super(struct super_block *sb)
}
err = -ENOMEM;
- /* Allocate fuse_dev for hiprio and notification queues */
- for (i = 0; i < VQ_REQUEST; i++) {
+ /* Allocate fuse_dev for all queues except the first request queue. */
+ for (i = 0; i < fs->nvqs; i++) {
struct virtio_fs_vq *fsvq = &fs->vqs[i];
+ if (i == VQ_REQUEST)
+ continue;
+
fsvq->fud = fuse_dev_alloc();
if (!fsvq->fud)
goto err_free_fuse_devs;
--
2.26.2.303.gf8c07b1a785-goog
