inode_permission NULL pointer dereference in 3.13-rc1

[Al Viro]

On Mon, Nov 25, 2013 at 08:06:48AM -0800, Christoph Hellwig wrote:
> On Sun, Nov 24, 2013 at 03:27:58PM +0000, Al Viro wrote:
> > which seems to leave two candidates - follow_dotdot_rcu() and path_init(),
> > both setting nd->inode to nd->path.dentry->d_inode...
> > 
> > Could you try to reproduce it with something like
> > 	if (read_seqretry(&mount_lock, nd->m_seq))
> > 		goto failed;
> > slapped before the success exit in follow_dotdot_rcu(), just to see if
> > we are hitting some races with umount here?
> 
> Still reproducable with the diff below.  Fixed by reverting the RCU'd
> vfsmounts.

.config, please - all I'm seeing on mine is a bloody awful leak somewhere
in VM that I'd been hunting for last week, so the damn thing gets OOMed
halfway through xfstests run ;-/