On Sat, Dec 13, 2025 at 10:28:29AM +0900, Qianchang Zhao wrote: > virtio_fs_add_queues_sysfs() creates per-queue sysfs kobjects via > kobject_create_and_add(). The current code checks the wrong variable > after the allocation: > > - kobject_create_and_add() may return NULL on failure. > - The code incorrectly checks fs->mqs_kobj (the parent kobject), which is > expected to be non-NULL at this point. > - If kobject_create_and_add() fails, fsvq->kobj is NULL but the code can > still call sysfs_create_group(fsvq->kobj, ...), leading to a NULL pointer > dereference and kernel panic (DoS). > > Fix by validating fsvq->kobj immediately after kobject_create_and_add() > and aborting on failure, so sysfs_create_group() is never called with a > NULL kobject. > > Reported-by: Qianchang Zhao <[email protected]> > Reported-by: Zhitong Liu <[email protected]> > Cc: [email protected] > Signed-off-by: Qianchang Zhao <[email protected]> > --- > fs/fuse/virtio_fs.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-)
This issue was fixed in October. It no longer exists in mainline Linux: commit c014021253d77cd89b2d8788ce522283d83fbd40 Author: Alok Tiwari <[email protected]> Date: Mon Oct 27 03:46:47 2025 -0700 virtio-fs: fix incorrect check for fsvq->kobj > diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c > index 6bc7c97b0..b2f6486fe 100644 > --- a/fs/fuse/virtio_fs.c > +++ b/fs/fuse/virtio_fs.c > @@ -373,7 +373,7 @@ static int virtio_fs_add_queues_sysfs(struct virtio_fs > *fs) > > sprintf(buff, "%d", i); > fsvq->kobj = kobject_create_and_add(buff, fs->mqs_kobj); > - if (!fs->mqs_kobj) { > + if (!fsvq->kobj) { > ret = -ENOMEM; > goto out_del; > } > -- > 2.34.1 >
signature.asc
Description: PGP signature
