diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2013-11-29 09:27:19 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-11-29 09:27:19 -0800 |
| commit | b01537bfbc832a09162e7189f63251a8785e2112 (patch) | |
| tree | f2e1b1430ed37ee173ead7bb78e0fcbdc8ab11ac | |
| parent | 282c183b0207a518bb3be1b65faa5a36d1529fa0 (diff) | |
| parent | d870b4a191a389c661cd40aacb06981c26b5e504 (diff) | |
| download | linux-b01537bfbc832a09162e7189f63251a8785e2112.tar.bz2 | |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull vfs dentry reference count fix from Al Viro.
This fixes a possible inode_permission NULL pointer dereference (and
other problems) that were due to the root dentry count being decremented
too much. In commit 48a066e72d97 ("RCU'd vfsmounts") the placement of
clearing the LOOKUP_RCU bit changed, and we then returned failure of
incrementing the lockref on the parent dentry with LOOKUP_RCU cleared.
But that meant we needed to go through the same cleanup routines that
the later failures did wrt LOOKUP_ROOT and nd->root.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
fix bogus path_put() of nd->root after some unlazy_walk() failures
| -rw-r--r-- | fs/namei.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/fs/namei.c b/fs/namei.c index 8f77a8cea289..c53d3a9547f9 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -513,8 +513,7 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry) if (!lockref_get_not_dead(&parent->d_lockref)) { nd->path.dentry = NULL; - rcu_read_unlock(); - return -ECHILD; + goto out; } /* |