[PATCH] fuse: don't pass a NULL inode to fuse_inode_backing() on release

["Orkun Emin Sarı via B4 Relay" <devnull+sariorkunemin.gmail.com@kernel.org>]

From: Orkun Emin Sarı <sariorkunemin@gmail.com>

cuse_release() and the error path of fuse_create_open() call
fuse_prepare_release() with a NULL fuse_inode. Since commit bbe2d73a8231
("fuse: don't assume ff->passthrough is set for FOPEN_PASSTHROUGH"),
fuse_prepare_release() calls fuse_inode_backing(fi) whenever the open
reply had FOPEN_PASSTHROUGH set, not only when ff->passthrough was set
up. A CUSE server that sets FOPEN_PASSTHROUGH thus makes the kernel
dereference a NULL pointer when the device is closed.

Pass a NULL backing when there is no inode. fuse_passthrough_release()
only prints it.

Found with AI-assisted code review (Claude Code).

Fixes: bbe2d73a8231 ("fuse: don't assume ff->passthrough is set for FOPEN_PASSTHROUGH")
Signed-off-by: Orkun Emin Sarı <sariorkunemin@gmail.com>
---
No reproducer was run and the fix is not runtime-tested. Build-tested
with LLVM=1 W=1 and FUSE_FS, CUSE and FUSE_PASSTHROUGH enabled.
---
 fs/fuse/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index d5e1cb53d8..36144fdd69 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -320,7 +320,7 @@ static void fuse_prepare_release(struct fuse_inode *fi, struct fuse_file *ff,
 	struct fuse_release_args *ra = &ff->args->release_args;
 
 	if (fuse_is_passthrough(ff))
-		fuse_passthrough_release(ff, fuse_inode_backing(fi));
+		fuse_passthrough_release(ff, fi ? fuse_inode_backing(fi) : NULL);
 
 	/* Inode is NULL on error path of fuse_create_open() */
 	if (likely(fi)) {

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261105-fuse-cuse-release-db795aa69e2c

Best regards,
--  
Orkun Emin Sarı <sariorkunemin@gmail.com>