inode_permission NULL pointer dereference in 3.13-rc1

[Christoph Hellwig]

On Sun, Nov 24, 2013 at 03:27:58PM +0000, Al Viro wrote:
> which seems to leave two candidates - follow_dotdot_rcu() and path_init(),
> both setting nd->inode to nd->path.dentry->d_inode...
> 
> Could you try to reproduce it with something like
> 	if (read_seqretry(&mount_lock, nd->m_seq))
> 		goto failed;
> slapped before the success exit in follow_dotdot_rcu(), just to see if
> we are hitting some races with umount here?

Still reproducable with the diff below.  Fixed by reverting the RCU'd
vfsmounts.


diff --git a/fs/namei.c b/fs/namei.c
index 8f77a8c..856e4d5 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1158,6 +1158,10 @@ static int follow_dotdot_rcu(struct nameidata *nd)
 	}
 	follow_mount_rcu(nd);
 	nd->inode = nd->path.dentry->d_inode;
+
+	if (read_seqretry(&mount_lock, nd->m_seq))
+		goto failed;
+
 	return 0;
 
 failed: