fuse: reject a duplicate fd= mount option

Browse source

fuse_opt_fd() stored the fuse device in ctx->fud and bumped its refcount
unconditionally:

        ctx->fud = fuse_dev_grab(file);

If fd= is given twice (two fsconfig FSCONFIG_SET_FD calls), the second
call overwrites ctx->fud and grabs the new device, while the reference
taken on the first device is never released - a permanent refcount leak
that pins the first fuse_dev until reboot.

Reject a second fd= outright.  ctx is zeroed on allocation, so a non-NULL
ctx->fud reliably means the option was already processed.

Fixes: d42eb23b2e ("fuse: don't require /dev/fuse fd to be kept open during mount")
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

...

This commit is contained in:

Baokun Li 2026-08-11 12:53:50 +08:00 • committed by Miklos Szeredi

parent 4deb3edead

commit ed97699493

1 changed files with 3 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

fs/fuse/inode.c

View file