diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2016-02-27 19:23:16 -0500 |
|---|---|---|
| committer | Sasha Levin <sasha.levin@oracle.com> | 2016-03-09 13:15:13 -0500 |
| commit | 9b77cd137fd841d7a14e1c9428cfc49f4df0306e (patch) | |
| tree | 571c08f94d18e00ddb986a07149a7b97f8bb258f | |
| parent | 3960cde3e356057bd60adce1b625a7d178b9581c (diff) | |
| download | lwn-9b77cd137fd841d7a14e1c9428cfc49f4df0306e.tar.gz lwn-9b77cd137fd841d7a14e1c9428cfc49f4df0306e.zip | |
namei: ->d_inode of a pinned dentry is stable only for positives
[ Upstream commit d4565649b6d6923369112758212b851adc407f0c ]
both do_last() and walk_component() risk picking a NULL inode out
of dentry about to become positive, *then* checking its flags and
seeing that it's not negative anymore and using (already stale by
then) value they'd fetched earlier. Usually ends up oopsing soon
after that...
Cc: stable@vger.kernel.org # v3.13+
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
| -rw-r--r-- | fs/namei.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/namei.c b/fs/namei.c index 438572278a9e..f3cc848da8bc 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1619,10 +1619,10 @@ static inline int walk_component(struct nameidata *nd, struct path *path, if (err < 0) goto out_err; - inode = path->dentry->d_inode; err = -ENOENT; if (d_is_negative(path->dentry)) goto out_path_put; + inode = path->dentry->d_inode; } if (should_follow_link(path->dentry, follow)) { @@ -3078,6 +3078,7 @@ retry_lookup: path_to_nameidata(path, nd); goto out; } + inode = path->dentry->d_inode; finish_lookup: /* we _can_ be in RCU mode here */ if (should_follow_link(path->dentry, !symlink_ok)) { |