On Sat, Dec 13, 2025 at 10:28:29AM +0900, Qianchang Zhao wrote:

virtio_fs_add_queues_sysfs() creates per-queue sysfs kobjects via kobject_create_and_add(). The current code checks the wrong variable after the allocation:

• kobject_create_and_add() may return NULL on failure.
• The code incorrectly checks fs->mqs_kobj (the parent kobject), which is expected to be non-NULL at this point.
• If kobject_create_and_add() fails, fsvq->kobj is NULL but the code can still call sysfs_create_group(fsvq->kobj, ...), leading to a NULL pointer dereference and kernel panic (DoS).

Fix by validating fsvq->kobj immediately after kobject_create_and_add() and aborting on failure, so sysfs_create_group() is never called with a NULL kobject.

Reported-by: Qianchang Zhao pioooooooooip@gmail.com Reported-by: Zhitong Liu liuzhitong1993@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Qianchang Zhao pioooooooooip@gmail.com

---

fs/fuse/virtio_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

This issue was fixed in October. It no longer exists in mainline Linux:

commit c014021253d77cd89b2d8788ce522283d83fbd40 Author: Alok Tiwari alok.a.tiwari@oracle.com Date: Mon Oct 27 03:46:47 2025 -0700

virtio-fs: fix incorrect check for fsvq->kobj

diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index 6bc7c97b0..b2f6486fe 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -373,7 +373,7 @@ static int virtio_fs_add_queues_sysfs(struct virtio_fs *fs) sprintf(buff, "%d", i); fsvq->kobj = kobject_create_and_add(buff, fs->mqs_kobj);

• if (!fs->mqs_kobj) {
  

• if (!fsvq->kobj) {
  ret = -ENOMEM;
  goto out_del;
  

  }

-- 2.34.1