fuse: always initialize sb->s_fs_info
authorMiklos Szeredi <mszeredi@redhat.com>
Thu, 21 Oct 2021 08:01:39 +0000 (10:01 +0200)
committerMiklos Szeredi <mszeredi@redhat.com>
Thu, 21 Oct 2021 08:01:39 +0000 (10:01 +0200)
commit80019f1138324b6f35ae728b4f25eeb08899b452
tree3a6508d79d7938ac7be3a6b6c35d9ff2d1fec14c
parentc191cd07ee948c93081d8e4cba43d23b18b2f3da
fuse: always initialize sb->s_fs_info

Syzkaller reports a null pointer dereference in fuse_test_super() that is
caused by sb->s_fs_info being NULL.

This is due to the fact that fuse_fill_super() is initializing s_fs_info,
which is too late, it's already on the fs_supers list.  The initialization
needs to be done in sget_fc() with the sb_lock held.

Move allocation of fuse_mount and fuse_conn from fuse_fill_super() into
fuse_get_tree().

After this ->kill_sb() will always be called with non-NULL ->s_fs_info,
hence fuse_mount_destroy() can drop the test for non-NULL "fm".

Reported-by: syzbot+74a15f02ccb51f398601@syzkaller.appspotmail.com
Fixes: 5d5b74aa9c76 ("fuse: allow sharing existing sb")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
fs/fuse/inode.c