[PATCH] fuse: add missing NULL check for fget() in fuse_parse_param()

[PATCH] fuse: add missing NULL check for fget() in fuse_parse_param()

[David Carlier]

In the OPT_FD case of fuse_parse_param(), when using the old mount API,
fget() is called on the user-supplied file descriptor but its return
value is not checked for NULL before being passed to fuse_opt_fd().
fuse_opt_fd() unconditionally dereferences file->f_op, causing a kernel
NULL pointer dereference.

This is user-triggerable via: mount -t fuse -o fd=99999 dummy /mnt
where fd 99999 is not open.

The new mount API path (FSCONFIG_SET_FD) is not affected because
fsopen.c validates the fd with fget_raw() + NULL check before setting
param->file.

Add a NULL check after fget() and return an error via invalfc() when
the fd is invalid.

Fixes: 3f2496deff35 ("fuse: don't require /dev/fuse fd to be kept open during mount")
Signed-off-by: David Carlier <devnexen@gmail.com>
---
 fs/fuse/inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index af8ad96829fd..39b635651165 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -862,6 +862,8 @@ static int fuse_parse_param(struct fs_context *fsc, struct fs_parameter *param)
 			return fuse_opt_fd(fsc, param->file);
 		} else {
 			struct file *file __free(fput) = fget(result.uint_32);
+			if (!file)
+				return invalfc(fsc, "Invalid fuse fd");
 			return fuse_opt_fd(fsc, file);
 		}
 
-- 
2.53.0

Re: [PATCH] fuse: add missing NULL check for fget() in fuse_parse_param()

[Joanne Koong]

On Wed, Mar 18, 2026 at 11:53 AM David Carlier <devnexen@gmail.com> wrote:
>
> In the OPT_FD case of fuse_parse_param(), when using the old mount API,
> fget() is called on the user-supplied file descriptor but its return
> value is not checked for NULL before being passed to fuse_opt_fd().
> fuse_opt_fd() unconditionally dereferences file->f_op, causing a kernel
> NULL pointer dereference.
>
> This is user-triggerable via: mount -t fuse -o fd=99999 dummy /mnt
> where fd 99999 is not open.
>
> The new mount API path (FSCONFIG_SET_FD) is not affected because
> fsopen.c validates the fd with fget_raw() + NULL check before setting
> param->file.
>
> Add a NULL check after fget() and return an error via invalfc() when
> the fd is invalid.
>
> Fixes: 3f2496deff35 ("fuse: don't require /dev/fuse fd to be kept open during mount")
> Signed-off-by: David Carlier <devnexen@gmail.com>
> ---
>  fs/fuse/inode.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
> index af8ad96829fd..39b635651165 100644
> --- a/fs/fuse/inode.c
> +++ b/fs/fuse/inode.c
> @@ -862,6 +862,8 @@ static int fuse_parse_param(struct fs_context *fsc, struct fs_parameter *param)
>                         return fuse_opt_fd(fsc, param->file);
>                 } else {
>                         struct file *file __free(fput) = fget(result.uint_32);
> +                       if (!file)
> +                               return invalfc(fsc, "Invalid fuse fd");
>                         return fuse_opt_fd(fsc, file);
>                 }
>

Hi David,

I think this is already going to be fixed up in the fuse tree by
Miklos when he applies the next version of his cleanup series, as per
the conversation in [1].

Thanks,
Joanne

[1] https://lore.kernel.org/linux-fsdevel/20260316165320.3245526-5-mszeredi@redhat.com/t/#u

> --
> 2.53.0
>
>