linux-kernel - [PATCH] fuse: fix NULL dereference when new

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 24 May 2018 21:20:04 +0100
From:   Stefan Hajnoczi <stefanha@...hat.com>
To:     linux-fsdevel@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, Miklos Szeredi <miklos@...redi.hu>,
        Stefan Hajnoczi <stefanha@...hat.com>
Subject: [PATCH] fuse: fix NULL dereference when new_inode() fails

fuse_ctl_remove_conn() dereferences d_inode(fc->ctl_dentry[i]).  If
fuse_ctl_add_dentry() failed to allocate the inode then this field is
NULL and it's not safe to call fuse_ctl_remove_conn().

This patch frees partially initialized dentries in the
fuse_ctl_add_dentry() error case to solve the NULL dereference.

Signed-off-by: Stefan Hajnoczi <stefanha@...hat.com>
---
I spotted this when reading the code.  Compile-tested only.

 fs/fuse/control.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/fuse/control.c b/fs/fuse/control.c
index b9ea99c5b5b3..ef3af9c32147 100644
--- a/fs/fuse/control.c
+++ b/fs/fuse/control.c
@@ -211,10 +211,13 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent,
 	if (!dentry)
 		return NULL;
 
-	fc->ctl_dentry[fc->ctl_ndents++] = dentry;
 	inode = new_inode(fuse_control_sb);
-	if (!inode)
+	if (!inode) {
+		dput(dentry);
 		return NULL;
+	}
+
+	fc->ctl_dentry[fc->ctl_ndents++] = dentry;
 
 	inode->i_ino = get_next_ino();
 	inode->i_mode = mode;
-- 
2.17.0