2021-05-25 19:29:28

by Greg Kurz

Subject: [PATCH 1/4] fuse: Fix crash in fuse_dentry_automount() error path

If fuse_fill_super_submount() returns an error, the error path
triggers a crash:

[ 26.206673] BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
[ 26.226362] RIP: 0010:__list_del_entry_valid+0x25/0x90
[...]
[ 26.247938] Call Trace:
[ 26.248300] fuse_mount_remove+0x2c/0x70 [fuse]
[ 26.248892] virtio_kill_sb+0x22/0x160 [virtiofs]
[ 26.249487] deactivate_locked_super+0x36/0xa0
[ 26.250077] fuse_dentry_automount+0x178/0x1a0 [fuse]

The crash happens because fuse_mount_remove() assumes that the FUSE
mount was already added to list under the FUSE connection, but this
only done after fuse_fill_super_submount() has returned success.

This means that until fuse_fill_super_submount() has returned success,
the FUSE mount isn't actually owned by the superblock. We should thus
reclaim ownership by clearing sb->s_fs_info, which will skip the call
to fuse_mount_remove(), and perform rollback, like virtio_fs_get_tree()
already does for the root sb.

Fixes: bf109c64040f ("fuse: implement crossmounts")
Cc: [email protected]
Cc: [email protected] # v5.10+
Signed-off-by: Greg Kurz <[email protected]>
---
fs/fuse/dir.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 1b6c001a7dd1..01559061cbfb 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -339,8 +339,12 @@ static struct vfsmount *fuse_dentry_automount(struct path *path)

/* Initialize superblock, making @mp_fi its root */
err = fuse_fill_super_submount(sb, mp_fi);
- if (err)
+ if (err) {
+ fuse_conn_put(fc);
+ kfree(fm);
+ sb->s_fs_info = NULL;
goto out_put_sb;
+ }

sb->s_flags |= SB_ACTIVE;
fsc->root = dget(sb->s_root);
--
2.31.1

2021-05-27 09:52:52

by Max Reitz

Subject: Re: [Virtio-fs] [PATCH 1/4] fuse: Fix crash in fuse_dentry_automount() error path

On 25.05.21 17:02, Greg Kurz wrote:
> If fuse_fill_super_submount() returns an error, the error path
> triggers a crash:
>
> [ 26.206673] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [...]
> [ 26.226362] RIP: 0010:__list_del_entry_valid+0x25/0x90
> [...]
> [ 26.247938] Call Trace:
> [ 26.248300] fuse_mount_remove+0x2c/0x70 [fuse]
> [ 26.248892] virtio_kill_sb+0x22/0x160 [virtiofs]
> [ 26.249487] deactivate_locked_super+0x36/0xa0
> [ 26.250077] fuse_dentry_automount+0x178/0x1a0 [fuse]
>
> The crash happens because fuse_mount_remove() assumes that the FUSE
> mount was already added to list under the FUSE connection, but this
> only done after fuse_fill_super_submount() has returned success.
>
> This means that until fuse_fill_super_submount() has returned success,
> the FUSE mount isn't actually owned by the superblock. We should thus
> reclaim ownership by clearing sb->s_fs_info, which will skip the call
> to fuse_mount_remove(), and perform rollback, like virtio_fs_get_tree()
> already does for the root sb.
>
> Fixes: bf109c64040f ("fuse: implement crossmounts")
> Cc: [email protected]
> Cc: [email protected] # v5.10+
> Signed-off-by: Greg Kurz <[email protected]>
> ---
> fs/fuse/dir.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)

Reviewed-by: Max Reitz <[email protected]>