[PATCH] fuse: check fi is not NULL before calling fuse_passthrough_release()

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

fuse_create_open() calls fuse_sync_release() with a NULL fuse_inode
when fuse_iget() fails. This propagates to fuse_prepare_release(),
which passes the NULL fi to fuse_inode_backing() via the
fuse_passthrough_release() call, resulting in a NULL pointer
dereference.

The existing comment in fuse_prepare_release() documents that the
inode can be NULL on the error path of fuse_create_open(), and the
fi->lock access below is already guarded with if (likely(fi)), but
the passthrough release path added by commit 4a90451bbc7f ("fuse:
implement open in passthrough mode") was not given the same
protection.

Add the missing NULL check for fi before calling
fuse_passthrough_release().

Found by syzkaller.

Fixes: 4a90451bbc7f ("fuse: implement open in passthrough mode")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/fuse/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index c59452d60b8d..9b368eab159c 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -313,7 +313,7 @@ static void fuse_prepare_release(struct fuse_inode *fi, struct fuse_file *ff,
 	struct fuse_conn *fc = ff->fm->fc;
 	struct fuse_release_args *ra = &ff->args->release_args;
 
-	if (fuse_file_passthrough(ff))
+	if (fi && fuse_file_passthrough(ff))
 		fuse_passthrough_release(ff, fuse_inode_backing(fi));
 
 	/* Inode is NULL on error path of fuse_create_open() */
-- 
2.47.3