[PATCH next] fuse: Uninitialized variable in fuse_epoch_work()

[PATCH next] fuse: Uninitialized variable in fuse_epoch_work()

[Dan Carpenter]

The "fm" pointer is either valid or uninitialized so checking for NULL
doesn't work.  Check the "inode" pointer instead.

Fixes: 64becd224ff9 ("fuse: new work queue to invalidate dentries from old epochs")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
 fs/fuse/dir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 761f4a14dc95..ec5042b47abb 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -201,7 +201,7 @@ void fuse_epoch_work(struct work_struct *work)
 	inode = fuse_ilookup(fc, FUSE_ROOT_ID, &fm);
 	iput(inode);
 
-	if (fm) {
+	if (inode) {
 		/* Remove all possible active references to cached inodes */
 		shrink_dcache_sb(fm->sb);
 	} else
-- 
2.51.0

Re: [PATCH next] fuse: Uninitialized variable in fuse_epoch_work()

[Luis Henriques]

On Fri, Nov 21 2025, Dan Carpenter wrote:

> The "fm" pointer is either valid or uninitialized so checking for NULL
> doesn't work.  Check the "inode" pointer instead.

Hmm?  Why do you say 'fm' isn't initialised?  That's what fuse_ilookup()
is doing, isn't it?

Cheers,
-- 
Luís

> Fixes: 64becd224ff9 ("fuse: new work queue to invalidate dentries from old epochs")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
>  fs/fuse/dir.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
> index 761f4a14dc95..ec5042b47abb 100644
> --- a/fs/fuse/dir.c
> +++ b/fs/fuse/dir.c
> @@ -201,7 +201,7 @@ void fuse_epoch_work(struct work_struct *work)
>  	inode = fuse_ilookup(fc, FUSE_ROOT_ID, &fm);
>  	iput(inode);
>  
> -	if (fm) {
> +	if (inode) {
>  		/* Remove all possible active references to cached inodes */
>  		shrink_dcache_sb(fm->sb);
>  	} else
> -- 
> 2.51.0
>

Re: [PATCH next] fuse: Uninitialized variable in fuse_epoch_work()

[Dan Carpenter]

On Fri, Nov 21, 2025 at 01:53:48PM +0000, Luis Henriques wrote:
> On Fri, Nov 21 2025, Dan Carpenter wrote:
> 
> > The "fm" pointer is either valid or uninitialized so checking for NULL
> > doesn't work.  Check the "inode" pointer instead.
> 
> Hmm?  Why do you say 'fm' isn't initialised?  That's what fuse_ilookup()
> is doing, isn't it?
> 

I just checked again on linux-next.  fuse_ilookup() only initializes
*fm on the success path.  It's either uninitialized or valid.

regards,
dan carpenter

Re: [PATCH next] fuse: Uninitialized variable in fuse_epoch_work()

[Luis Henriques]

On Fri, Nov 21 2025, Dan Carpenter wrote:

> On Fri, Nov 21, 2025 at 01:53:48PM +0000, Luis Henriques wrote:
>> On Fri, Nov 21 2025, Dan Carpenter wrote:
>> 
>> > The "fm" pointer is either valid or uninitialized so checking for NULL
>> > doesn't work.  Check the "inode" pointer instead.
>> 
>> Hmm?  Why do you say 'fm' isn't initialised?  That's what fuse_ilookup()
>> is doing, isn't it?
>> 
>
> I just checked again on linux-next.  fuse_ilookup() only initializes
> *fm on the success path.  It's either uninitialized or valid.

Yikes! You're absolutely right, I'm sorry for replying without checking.

Feel free to add my

Reviewed-by: Luis Henriques <luis@igalia.com>

Although I guess you're patch could also move the iput():

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 67e3340a443c..f2bac7b3a125 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -199,9 +199,8 @@ void fuse_epoch_work(struct work_struct *work)
 	down_read(&fc->killsb);
 
 	inode = fuse_ilookup(fc, FUSE_ROOT_ID, &fm);
-	iput(inode);
-
-	if (fm) {
+	if (inode) {
+		iput(inode);
 		/* Remove all possible active references to cached inodes */
 		shrink_dcache_sb(fm->sb);
 	} else

And thanks for your fix, Dan!

Cheers,
-- 
Luís

Re: [PATCH next] fuse: Uninitialized variable in fuse_epoch_work()

[Dan Carpenter]

On Sat, Nov 22, 2025 at 10:23:31AM +0000, Luis Henriques wrote:
> On Fri, Nov 21 2025, Dan Carpenter wrote:
> 
> > On Fri, Nov 21, 2025 at 01:53:48PM +0000, Luis Henriques wrote:
> >> On Fri, Nov 21 2025, Dan Carpenter wrote:
> >> 
> >> > The "fm" pointer is either valid or uninitialized so checking for NULL
> >> > doesn't work.  Check the "inode" pointer instead.
> >> 
> >> Hmm?  Why do you say 'fm' isn't initialised?  That's what fuse_ilookup()
> >> is doing, isn't it?
> >> 
> >
> > I just checked again on linux-next.  fuse_ilookup() only initializes
> > *fm on the success path.  It's either uninitialized or valid.
> 
> Yikes! You're absolutely right, I'm sorry for replying without checking.
> 
> Feel free to add my
> 
> Reviewed-by: Luis Henriques <luis@igalia.com>
> 
> Although I guess you're patch could also move the iput():
> 

Yeah.  Good point.  It's cleaner that way.  I've sent a v2.

regards,
dan carpenter