diff options
| author | Miklos Szeredi <mszeredi@redhat.com> | 2026-10-15 16:07:01 +0200 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@redhat.com> | 2026-10-16 12:15:28 +0200 |
| commit | f8cef5c74d8b5a982f49cc40d13cd5c3ea2eacf6 (patch) | |
| tree | 7d26d875bd46fa71a12ffde2abb475080a064fd1 /tools/lib/python | |
| parent | 294de5bbbc7ff564bae5a2c0492cbf0b9341ac9b (diff) | |
fuse: fix NULL pointer dereference in fuse_request_find
fuse_dev_install_with_pq() publishes fud->chan before it stores
fud->pq.processing. The write/splice_write and read paths treat a non-NULL
fud->chan as "installed" and then walk fpq->processing[] without taking
fch->lock, so they can see the new chan while processing is still NULL and
oops in fuse_request_find().
Fix by taking fpq->lock around the cmpxchg + fud->pq.processing assignment.
This protects all call sites that dereference fpq->processing, since these
have fpq->lock held.
Fixes: 48649c0603bd ("fuse: alloc pqueue before installing fch in fuse_dev")
Reported-by: Cen Zhang <zzzccc427@gmail.com>
Closes: https://lore.kernel.org/fuse-devel/pm-fuse-full-objects-candidate-0002-v2-17d6013e5066de33396c@gmail.com/
Reported-by: 马云龙 <yunlong_ma@buaa.edu.cn>
Closes: https://lore.kernel.org/all/5ddc8efe.1e6d2.1a11fbec860.Coremail.yunlong_ma@buaa.edu.cn/
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions