inode_permission NULL pointer dereference in 3.13-rc1

[Linus Torvalds]

On Fri, Nov 29, 2013 at 3:55 PM, Al Viro <viro at zeniv.linux.org.uk> wrote:
>
> Look at the end of vfs_rmdir(); d_delete() in there will turn dentry
> negative if nobody else hold references to it.  So yes, dentry of
> directory *can* go negative under you, unless you've grabbed a reference.
> Which we do not do in RCU mode, obviously.

Ugh. Right you are. I thought we tried to avoid that, but clearly we don't.

I wonder if we could try to avoid it, just unhash and kill the dentry.
And then do this all at dentry release time instead (so after the
appropriate RCU grace period). Because it really would be lovely if
d_inode was stable.

But I guess we might have filesystems that expect the synchronous
d_iput() for last use, and maybe there's even some performance
advantage to re-using the dentry for some loads..

            Linus