[RESEND,2/4] fuse kio: Check for null ep in pcs_rpc_deaccount_msg()

Submitted by Kirill Tkhai on Oct. 17, 2018, 9:08 a.m.

Details

Message ID 153976728628.29624.17951641990074801508.stgit@localhost.localdomain
State New
Series "Order rpc destroy with rpc_queue_work()"
Headers show

Commit Message

Kirill Tkhai Oct. 17, 2018, 9:08 a.m. 
This is the only msg->done() callback related function,
which does not check for ep != NULL. Despite all the
creators of a msg with such msg->destruct() method
(it's called in order msg->done --> msg->destruct())
take ep counter before they create such type the msg,
add a explicit check for that to catch hidden msg
cloning and other not obvious actions on msg.

Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
---
 fs/fuse/kio/pcs/pcs_rpc.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Patch hide | download patch | download mbox 

diff --git a/fs/fuse/kio/pcs/pcs_rpc.c b/fs/fuse/kio/pcs/pcs_rpc.c
index 27156a507a84..8c76bb44f0a2 100644
--- a/fs/fuse/kio/pcs/pcs_rpc.c
+++ b/fs/fuse/kio/pcs/pcs_rpc.c
@@ -1083,7 +1083,10 @@  static int rpc_check_memlimit(struct pcs_rpc * ep)
 
 void pcs_rpc_deaccount_msg(struct pcs_msg * msg)
 {
-	struct pcs_rpc * ep = msg->rpc;
+	struct pcs_rpc *ep = msg->rpc;
+
+	if (WARN_ON_ONCE(!ep))
+		return;
 
 	msg->rpc = NULL;
 	ep->eng->msg_count--;