cuse: prevent clone

[ Upstream commit 8217673d07256b22881127bf50dce874d0e51653 ]

For cloned connections cuse_channel_release() will be called more than
once, resulting in use after free.

Prevent device cloning for CUSE, which does not make sense at this point,
and highly unlikely to be used in real life.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index 00015d85138297b1c5e87158d75714e4a49a23dd..e51b7019e887118b07ee7fa4be2575cf8dfd8f05 100644 (file)
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -624,6 +624,8 @@ static int __init cuse_init(void)
        cuse_channel_fops.owner         = THIS_MODULE;
        cuse_channel_fops.open          = cuse_channel_open;
        cuse_channel_fops.release       = cuse_channel_release;
+       /* CUSE is not prepared for FUSE_DEV_IOC_CLONE */
+       cuse_channel_fops.unlocked_ioctl        = NULL;
 
        cuse_class = class_create(THIS_MODULE, "cuse");
        if (IS_ERR(cuse_class))