[Virtio-fs] [PATCH 1/2] fuse: virtiofs: Fix nullptr dereference
Stefan Hajnoczi
stefanha at redhat.com
Tue Apr 28 08:53:08 UTC 2020
On Mon, Apr 27, 2020 at 01:58:14PM -0400, Vivek Goyal wrote:
> On Fri, Apr 24, 2020 at 03:25:39PM +0900, Chirantan Ekbote wrote:
> > virtiofs device implementations are allowed to provide more than one
> > request queue. In this case `fsvq->fud` would not be initialized,
> > leading to a nullptr dereference later during driver initialization.
> >
> > Make sure that `fsvq->fud` is initialized for all request queues even if
> > the driver doesn't use them.
> >
> > Signed-off-by: Chirantan Ekbote <chirantan at chromium.org>
> > ---
> > fs/fuse/virtio_fs.c | 7 +++++--
> > 1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
> > index bade747689033..d3c38222a7e4e 100644
> > --- a/fs/fuse/virtio_fs.c
> > +++ b/fs/fuse/virtio_fs.c
> > @@ -1066,10 +1066,13 @@ static int virtio_fs_fill_super(struct super_block *sb)
> > }
> >
> > err = -ENOMEM;
> > - /* Allocate fuse_dev for hiprio and notification queues */
> > - for (i = 0; i < VQ_REQUEST; i++) {
> > + /* Allocate fuse_dev for all queues except the first request queue. */
> > + for (i = 0; i < fs->nvqs; i++) {
> > struct virtio_fs_vq *fsvq = &fs->vqs[i];
> >
> > + if (i == VQ_REQUEST)
> > + continue;
> > +
>
> These special conditions of initializing fuse device for one queue
> fusing fill_super_common() and rest of the queues outside of it, are
> bothering me. I am proposing a separate patch where all fuse device
> initialization/cleanup is done by the caller. It makes code look
> cleaner and easier to understand.
Nice!
Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/virtio-fs/attachments/20200428/5a5c9555/attachment.sig>
More information about the Virtio-fs
mailing list