[Top] [All Lists]

Re: inode_permission NULL pointer dereference in 3.13-rc1

To: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Subject: Re: inode_permission NULL pointer dereference in 3.13-rc1
From: Christoph Hellwig <hch@xxxxxxxxxxxxx>
Date: Mon, 25 Nov 2013 08:06:48 -0800
Cc: Christoph Hellwig <hch@xxxxxxxxxxxxx>, linux-fsdevel@xxxxxxxxxxxxxxx, xfs@xxxxxxxxxxx
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <20131124152758.GL10323@xxxxxxxxxxxxxxxxxx>
References: <20131124140413.GA19271@xxxxxxxxxxxxx> <20131124152758.GL10323@xxxxxxxxxxxxxxxxxx>
User-agent: Mutt/1.5.21 (2010-09-15)
On Sun, Nov 24, 2013 at 03:27:58PM +0000, Al Viro wrote:
> which seems to leave two candidates - follow_dotdot_rcu() and path_init(),
> both setting nd->inode to nd->path.dentry->d_inode...
> Could you try to reproduce it with something like
>       if (read_seqretry(&mount_lock, nd->m_seq))
>               goto failed;
> slapped before the success exit in follow_dotdot_rcu(), just to see if
> we are hitting some races with umount here?

Still reproducable with the diff below.  Fixed by reverting the RCU'd

diff --git a/fs/namei.c b/fs/namei.c
index 8f77a8c..856e4d5 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1158,6 +1158,10 @@ static int follow_dotdot_rcu(struct nameidata *nd)
        nd->inode = nd->path.dentry->d_inode;
+       if (read_seqretry(&mount_lock, nd->m_seq))
+               goto failed;
        return 0;

<Prev in Thread] Current Thread [Next in Thread>