Re: [PATCH v2] fuse: check for NULL root inode in fuse_fill_super_submount

[Jingbo Xu]

On 8/8/26 12:13 PM, Baokun Li wrote:
> fuse_iget() can return NULL when its inode allocation fails, but
> fuse_fill_super_submount() passed the result straight to get_fuse_inode()
> and decremented fi->nlookup without checking it:
> 
>         root = fuse_iget(sb, parent_fi->nodeid, ...);
>         fi = get_fuse_inode(root);
>         fi->nlookup--;
> 
> Inside fuse_iget() the inode allocation can fail and return NULL.  The
> submount root takes the iget5_locked() path, whose alloc_inode() can fail
> under memory pressure (the auto-submount branch can fail the same way in
> new_inode() or fuse_alloc_submount_lookup()):
> 
>         inode = iget5_locked(sb, nodeid, fuse_inode_eq, fuse_inode_set,
>                              &nodeid);
>         if (!inode)
>                 return NULL;
> 
> A NULL root makes get_fuse_inode() a container_of() on NULL and the
> nlookup decrement a write to a bogus address, oopsing the mount.  With
> CONFIG_KASAN the following null pointer dereference is reported when the
> root inode allocation of an auto-submount fails (e.g. under memory
> pressure):
> 
> ==================================================================
> BUG: KASAN: null-ptr-deref in fuse_get_tree_submount+0x656/0x8b0
> Read of size 8 at addr 00000000000002b0 by task ls/942
> CPU: 0 PID: 942 Comm: ls Tainted: G W 6.6 #15
> Call Trace:
>  <TASK>
>  fuse_get_tree_submount+0x656/0x8b0
>  vfs_get_tree+0x48/0x140
>  fc_mount+0x13/0x50
>  fuse_dentry_automount+0x7a/0xb0
>  __traverse_mounts+0xca/0x330
>  step_into+0x339/0xac0
>  path_lookupat+0xc5/0x2f0
>  filename_lookup+0x163/0x2a0
>  vfs_statx+0xd5/0x200
>  do_statx+0x83/0xd0
>  __x64_sys_statx+0xa0/0xc0
>  do_syscall_64+0x37/0x90
>  entry_SYSCALL_64_after_hwframe+0x78/0xe2
>  </TASK>
> ==================================================================
> 
> Return -ENOMEM instead; the caller tears down the partially built
> superblock on error, matching the other error returns in this
> function.
> 
> Fixes: 1866d779d5d2 ("fuse: Allow fuse_fill_super_common() for submounts")
> Signed-off-by: Baokun Li <libaokun@xxxxxxxxxxxxxxxxx>

LGTM.

Reviewed-by: Jingbo Xu \<jefflexu@xxxxxxxxxxxxxxxxx\>

> ---
> Changes since v1:
>  * Correct the Fixes tag.
> 
> v1: https://patch.msgid.link/20260806152134.1594639-1-libaokun@xxxxxxxxxxxxxxxxx
> 
>  fs/fuse/inode.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
> index d975073c6029..455c7feba057 100644
> --- a/fs/fuse/inode.c
> +++ b/fs/fuse/inode.c
> @@ -1639,6 +1639,8 @@ static int fuse_fill_super_submount(struct super_block *sb,
>  	fuse_fill_attr_from_inode(&root_attr, parent_fi);
>  	root = fuse_iget(sb, parent_fi->nodeid, 0, &root_attr, 0, 0,
>  			 fuse_get_evict_ctr(fm->fc));
> +	if (!root)
> +		return -ENOMEM;
>  	/*
>  	 * This inode is just a duplicate, so it is not looked up and
>  	 * its nlookup should not be incremented.  fuse_iget() does

-- 
Thanks,
Jingbo