namei: ->d_inode of a pinned dentry is stable only for positives (d4565649) · Commits · 戴 / test

both do_last() and walk_component() risk picking a NULL inode out of dentry about to become positive, *then* checking its flags and seeing that it's not negative anymore and using (already stale by then) value they'd fetched earlier. Usually ends up oopsing soon after that... Cc: stable@vger.kernel.org # v3.13+ Signed-off-by:

Al Viro <viro@zeniv.linux.org.uk>

fs/namei.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1743,11 +1743,11 @@ static int walk_component(struct nameidata *nd, int flags)
		if (err < 0)
		return err;

		inode = d_backing_inode(path.dentry);
		seq = 0; /* we are already out of RCU mode */
		err = -ENOENT;
		if (d_is_negative(path.dentry))
		goto out_path_put;
		inode = d_backing_inode(path.dentry);
		}

		if (flags & WALK_PUT)
		@@ -3192,12 +3192,12 @@ retry_lookup:
		return error;

		BUG_ON(nd->flags & LOOKUP_RCU);
		inode = d_backing_inode(path.dentry);
		seq = 0; /* out of RCU mode, so the value doesn't matter */
		if (unlikely(d_is_negative(path.dentry))) {
		path_to_nameidata(&path, nd);
		return -ENOENT;
		}
		inode = d_backing_inode(path.dentry);
		finish_lookup:
		if (nd->depth)
		put_link(nd);

Admin message