[PATCH 1/2] fuse: virtiofs: Fix nullptr dereference

From: Chirantan Ekbote <chirantan@chromium.org>
To: Miklos Szeredi <miklos@szeredi.hu>
Cc: Vivek Goyal <vgoyal@redhat.com>,
	Stefan Hajnoczi <stefanha@redhat.com>,
	linux-fsdevel@vger.kernel.org, virtio-fs@redhat.com,
	Dylan Reid <dgreid@chromium.org>,
	Suleiman Souhlal <suleiman@chromium.org>,
	Chirantan Ekbote <chirantan@chromium.org>
Subject: [PATCH 1/2] fuse: virtiofs: Fix nullptr dereference
Date: Fri, 24 Apr 2020 15:25:39 +0900	[thread overview]
Message-ID: <20200424062540.23679-1-chirantan@chromium.org> (raw)

virtiofs device implementations are allowed to provide more than one
request queue.  In this case `fsvq->fud` would not be initialized,
leading to a nullptr dereference later during driver initialization.

Make sure that `fsvq->fud` is initialized for all request queues even if
the driver doesn't use them.

Signed-off-by: Chirantan Ekbote <chirantan@chromium.org>
---
 fs/fuse/virtio_fs.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index bade747689033..d3c38222a7e4e 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -1066,10 +1066,13 @@ static int virtio_fs_fill_super(struct super_block *sb)
 	}
 
 	err = -ENOMEM;
-	/* Allocate fuse_dev for hiprio and notification queues */
-	for (i = 0; i < VQ_REQUEST; i++) {
+	/* Allocate fuse_dev for all queues except the first request queue. */
+	for (i = 0; i < fs->nvqs; i++) {
 		struct virtio_fs_vq *fsvq = &fs->vqs[i];
 
+		if (i == VQ_REQUEST)
+			continue;
+
 		fsvq->fud = fuse_dev_alloc();
 		if (!fsvq->fud)
 			goto err_free_fuse_devs;
-- 
2.26.2.303.gf8c07b1a785-goog

