* Alex Chen (alex.c...@huawei.com) wrote:
> The 'ch' will be NULL in the following stack:
> send_notify_iov()->fuse_send_msg()->virtio_send_msg(),
> so we should check 'ch' is valid before dereferencing it
>
> Reported-by: Euler Robot <euler.ro...@huawei.com>
> Signed-off-by: Alex Chen <alex.c...@huawei.com>
Please check, but I don't think we can currently hit this because
we never call send_notify_iov - it's currently called by
fuse_lowlevel_notify_inval_entry, inval_inode, and
fuse_lowlevel_notify_poll -
but I don't think those are called anywhere.
In that case, probably the best fix is to remove those until we
put notify back in.
Dave
> ---
> tools/virtiofsd/fuse_virtio.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c
> index 623812c432..31b2187a15 100644
> --- a/tools/virtiofsd/fuse_virtio.c
> +++ b/tools/virtiofsd/fuse_virtio.c
> @@ -205,6 +205,8 @@ static void copy_iov(struct iovec *src_iov, int src_count,
> int virtio_send_msg(struct fuse_session *se, struct fuse_chan *ch,
> struct iovec *iov, int count)
> {
> + assert(ch);
> +
> FVRequest *req = container_of(ch, FVRequest, ch);
> struct fv_QueueInfo *qi = ch->qi;
> VuDev *dev = &se->virtio_dev->dev;
> --
> 2.19.1
>
--
Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK
