From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758357AbbFABba (ORCPT ); Sun, 31 May 2015 21:31:30 -0400 Received: from mail-pd0-f181.google.com ([209.85.192.181]:35272 "EHLO mail-pd0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754175AbbFABbV (ORCPT ); Sun, 31 May 2015 21:31:21 -0400 From: Jeremiah Mahler To: Miklos Szeredi Cc: fuse-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, Jeremiah Mahler Subject: [PATCH] fuse: avoid clobbering fc->release with fuse_conn_init(fc) Date: Sun, 31 May 2015 18:31:04 -0700 Message-Id: <1433122264-6702-1-git-send-email-jmmahler@gmail.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <20150531235259.GA4620@hudson.localdomain> References: <20150531235259.GA4620@hudson.localdomain> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org fuse_conn_init(fc) zeros the entire fc structure before it assigns specific values. Since fc->release is set before fuse_conn_init(fc) is called, the value gets set to zero, which results in a NULL pointer deference when fc->release() is called. Fix the problem by assigning fc->release after calling fuse_conn_init(fc) instead of before. Signed-off-by: Jeremiah Mahler Fixes: daccc092d1a2 ("fuse: initialize fc->release before calling it") --- fs/fuse/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c index 01ff55d..2913db2 100644 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -1076,8 +1076,8 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) if (!fc) goto err_fput; - fc->release = fuse_free_conn; fuse_conn_init(fc); + fc->release = fuse_free_conn; fud = fuse_dev_alloc(fc); if (!fud) -- 2.1.4