From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-fsdevel-owner@vger.kernel.org>
Received: from zeniv.linux.org.uk ([195.92.253.2]:53294 "EHLO
        ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1728039AbeGRLVf (ORCPT
        <rfc822;linux-fsdevel@vger.kernel.org>);
        Wed, 18 Jul 2018 07:21:35 -0400
Date: Wed, 18 Jul 2018 11:44:12 +0100
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Miklos Szeredi <miklos@szeredi.hu>, linux-fsdevel@vger.kernel.org,
        syzbot <syzbot+b62f08f4d5857755e3bc@syzkaller.appspotmail.com>
Subject: Re: [PATCH (resend)] fuse: Fix oops at process_init_reply().
Message-ID: <20180718104412.GQ30522@ZenIV.linux.org.uk>
References: <1531908438-3783-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1531908438-3783-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp>
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

On Wed, Jul 18, 2018 at 07:07:18PM +0900, Tetsuo Handa wrote:
> syzbot is hitting NULL pointer dereference at process_init_reply() [1].
> This is because deactivate_locked_super() is called before response for
> initial request is processed. Fix this by protecting process_init_reply()
> using fc->killsb.

IDGI... why is FUSE_INIT asynchronous in the first place?  What's the point
returning a superblock before FUSE_INIT completes, seeing that things like
fuse_get_req() block until that one is over?