[PATCH] fuse: add missing NULL check for fget() in fuse_parse_param()

[David Carlier <devnexen@gmail.com>]

In the OPT_FD case of fuse_parse_param(), when using the old mount API,
fget() is called on the user-supplied file descriptor but its return
value is not checked for NULL before being passed to fuse_opt_fd().
fuse_opt_fd() unconditionally dereferences file->f_op, causing a kernel
NULL pointer dereference.

This is user-triggerable via: mount -t fuse -o fd=99999 dummy /mnt
where fd 99999 is not open.

The new mount API path (FSCONFIG_SET_FD) is not affected because
fsopen.c validates the fd with fget_raw() + NULL check before setting
param->file.

Add a NULL check after fget() and return an error via invalfc() when
the fd is invalid.

Fixes: 3f2496deff35 ("fuse: don't require /dev/fuse fd to be kept open during mount")
Signed-off-by: David Carlier <devnexen@gmail.com>
---
 fs/fuse/inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index af8ad96829fd..39b635651165 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -862,6 +862,8 @@ static int fuse_parse_param(struct fs_context *fsc, struct fs_parameter *param)
 			return fuse_opt_fd(fsc, param->file);
 		} else {
 			struct file *file __free(fput) = fget(result.uint_32);
+			if (!file)
+				return invalfc(fsc, "Invalid fuse fd");
 			return fuse_opt_fd(fsc, file);
 		}
 
-- 
2.53.0