Miklos Szeredi d6f4d0cf37 fuse: fix control dir setup and teardown ... commit 6becdb601bae2a043d7fb9762c4d48699528ea6e upstream. syzbot is reporting NULL pointer dereference at fuse_ctl_remove_conn() [1]. Since fc->ctl_ndents is incremented by fuse_ctl_add_conn() when new_inode() failed, fuse_ctl_remove_conn() reaches an inode-less dentry and tries to clear d_inode(dentry)->i_private field. Fix by only adding the dentry to the array after being fully set up. When tearing down the control directory, do d_invalidate() on it to get rid of any mounts that might have been added. [1] https://syzkaller.appspot.com/bug?id=f396d863067238959c91c0b7cfc10b163638cac6 Reported-by: syzbot <syzbot+32c236387d66c4516827@syzkaller.appspotmail.com> Fixes: bafa96541b ("[PATCH] fuse: add control filesystem") Cc: <stable@vger.kernel.org> # v2.6.18 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-07-03 11:21:28 +02:00
..
control.c	fuse: fix control dir setup and teardown	2018-07-03 11:21:28 +02:00
cuse.c	fuse: Add reference counting for fuse_io_priv	2016-04-12 09:08:58 -07:00
dev.c	fuse: fix use after free issue in fuse_dev_do_read()	2017-02-23 17:43:09 +01:00
dir.c	fuse: atomic_o_trunc should truncate pagecache	2018-07-03 11:21:28 +02:00
file.c	fuse: initialize the flock flag in fuse_file on allocation	2017-08-16 13:40:28 -07:00
fuse_i.h	fuse: Add reference counting for fuse_io_priv	2016-04-12 09:08:58 -07:00
inode.c	fuse: don't keep dead fuse_conn at fuse_fill_super().	2018-07-03 11:21:28 +02:00
Kconfig	fuse: Move CUSE Kconfig entry from fs/Kconfig into fs/fuse/Kconfig	2013-01-17 13:08:45 +01:00
Makefile