fuse-io-uring: Fix UAF and NULL deref in startup error path

In fuse_uring_start(), the error path called fuse_session_destruct_uring()
which frees fuse_ring, then stored the freed pointer in se->uring.pool.
On session shutdown, the session loop cleanup checks if (se->uring.pool)
and calls fuse_uring_stop() — dereferencing the freed memory (use-after-free).

Fix by setting se->uring.pool = NULL in the error path so the cleanup
check is skipped. Also add a NULL guard before the destruct call to handle
the case where fuse_create_ring() itself returns NULL, which would cause
a NULL pointer dereference at fuse_ring->nr_queues.

Fixes CVE-2026-33150

Signed-off-by: Abhinav Agarwal <abhinav.agarwal@rubrik.com>

Author: abhinavagarwal07

lib/fuse_uring.c

@@ -925,8 +925,9 @@ int fuse_uring_start(struct fuse_session *se)
 err:
 	if (err) {
 		/* Note all threads need to have been started */
-		fuse_session_destruct_uring(fuse_ring);
-		se->uring.pool = fuse_ring;
+		if (fuse_ring)
+			fuse_session_destruct_uring(fuse_ring);
+		se->uring.pool = NULL;
 	}
 	return err;
 }