Re: inode_permission NULL pointer dereference in 3.13-rc1

[Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>]

On Thu, Nov 28, 2013 at 6:07 PM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
>    Thus the
> comment about unbalanced dput() somewhere; the question is _where_ had
> that dput() been.

Clearing the LOOKUP_RCU bit is what I was looking at, because doing
that without doing the proper successful lockref_get_not_dead() ends
up being equivalent to missing a dget(), not an extra dput(). Which
was why I was looking at unlazy_walk() -> terminate_walk().

But I really don't see anything wrong. That was the only really
obvious sequence where you changed things. Everything else seems to be
a pretty 1:1 conversion.

            Linus