Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4565649 authored by Al Viro's avatar Al Viro
Browse files

namei: ->d_inode of a pinned dentry is stable only for positives 



both do_last() and walk_component() risk picking a NULL inode out
of dentry about to become positive, *then* checking its flags and
seeing that it's not negative anymore and using (already stale by
then) value they'd fetched earlier.  Usually ends up oopsing soon
after that...

Cc: stable@vger.kernel.org # v3.13+
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent c80567c8

fs/namei.c

+2 −2
Original line number Diff line number Diff line
@@ -1743,11 +1743,11 @@ static int walk_component(struct nameidata *nd, int flags) 
		if (err < 0)

			return err;



		inode = d_backing_inode(path.dentry);

		seq = 0;	/* we are already out of RCU mode */

		err = -ENOENT;

		if (d_is_negative(path.dentry))

			goto out_path_put;

		inode = d_backing_inode(path.dentry);

	}



	if (flags & WALK_PUT)
@@ -3192,12 +3192,12 @@ static int do_last(struct nameidata *nd, 
		return error;



	BUG_ON(nd->flags & LOOKUP_RCU);

	inode = d_backing_inode(path.dentry);

	seq = 0;	/* out of RCU mode, so the value doesn't matter */

	if (unlikely(d_is_negative(path.dentry))) {

		path_to_nameidata(&path, nd);

		return -ENOENT;

	}

	inode = d_backing_inode(path.dentry);

finish_lookup:

	if (nd->depth)

		put_link(nd);