fuse: Avoid fuse_file_args null pointer dereference

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



The test for NULL was done for the member of union fuse_file_args,
but not for fuse_file_args itself.

Fixes: e26ee4efbc796 ("fuse: allocate ff->release_args only if release is needed")
Signed-off-by: Bernd Schubert <bschubert@xxxxxxx>

---
I'm currently going through all the recent patches again and noticed
in code review. I guess this falls through testing, because we don't
run xfstests that have !fc->no_opendir || !fc->no_open.

Note: Untested except that it compiles.

Note2: Our IT just broke sendmail, I'm quickly sending through thunderbird,
I hope doesn't change the patch format.

 fs/fuse/file.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index b57ce4157640..0ff865457ea6 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -102,7 +102,8 @@ static void fuse_release_end(struct fuse_mount *fm, struct fuse_args *args,
 static void fuse_file_put(struct fuse_file *ff, bool sync)
 {
 	if (refcount_dec_and_test(&ff->count)) {
-		struct fuse_release_args *ra = &ff->args->release_args;
+		struct fuse_release_args *ra =
+			ff->args ? &ff->args->release_args : NULL;
 		struct fuse_args *args = (ra ? &ra->args : NULL);
if (ra && ra->inode)
@@ -292,7 +293,7 @@ static void fuse_prepare_release(struct fuse_inode *fi, struct fuse_file *ff,
 				 unsigned int flags, int opcode, bool sync)
 {
 	struct fuse_conn *fc = ff->fm->fc;
-	struct fuse_release_args *ra = &ff->args->release_args;
+	struct fuse_release_args *ra = ff->args ? &ff->args->release_args : NULL;
if (fuse_file_passthrough(ff))
 		fuse_passthrough_release(ff, fuse_inode_backing(fi));
@@ -337,7 +338,7 @@ void fuse_file_release(struct inode *inode, struct fuse_file *ff,
 		       unsigned int open_flags, fl_owner_t id, bool isdir)
 {
 	struct fuse_inode *fi = get_fuse_inode(inode);
-	struct fuse_release_args *ra = &ff->args->release_args;
+	struct fuse_release_args *ra = ff->args ? &ff->args->release_args : NULL;
 	int opcode = isdir ? FUSE_RELEASEDIR : FUSE_RELEASE;
fuse_prepare_release(fi, ff, open_flags, opcode, false);




[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [NTFS 3]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [NTFS 3]     [Samba]     [Device Mapper]     [CEPH Development]

  Powered by Linux