Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2016-02-27 19:23:16 -0500
committerSasha Levin <sasha.levin@oracle.com>2016-03-09 13:15:13 -0500
commit9b77cd137fd841d7a14e1c9428cfc49f4df0306e (patch)
tree571c08f94d18e00ddb986a07149a7b97f8bb258f
parent3960cde3e356057bd60adce1b625a7d178b9581c (diff)
namei: ->d_inode of a pinned dentry is stable only for positives
[ Upstream commit d4565649b6d6923369112758212b851adc407f0c ] both do_last() and walk_component() risk picking a NULL inode out of dentry about to become positive, *then* checking its flags and seeing that it's not negative anymore and using (already stale by then) value they'd fetched earlier. Usually ends up oopsing soon after that... Cc: stable@vger.kernel.org # v3.13+ Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
-rw-r--r--fs/namei.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/namei.c b/fs/namei.c
index 438572278a9e..f3cc848da8bc 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1619,10 +1619,10 @@ static inline int walk_component(struct nameidata *nd, struct path *path,
if (err < 0)
goto out_err;
- inode = path->dentry->d_inode;
err = -ENOENT;
if (d_is_negative(path->dentry))
goto out_path_put;
+ inode = path->dentry->d_inode;
}
if (should_follow_link(path->dentry, follow)) {
@@ -3078,6 +3078,7 @@ retry_lookup:
path_to_nameidata(path, nd);
goto out;
}
+ inode = path->dentry->d_inode;
finish_lookup:
/* we _can_ be in RCU mode here */
if (should_follow_link(path->dentry, !symlink_ok)) {