diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2013-11-29 18:27:19 +0100 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-11-29 18:27:19 +0100 |
commit | b01537bfbc832a09162e7189f63251a8785e2112 (patch) | |
tree | f2e1b1430ed37ee173ead7bb78e0fcbdc8ab11ac /fs | |
parent | Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux (diff) | |
parent | fix bogus path_put() of nd->root after some unlazy_walk() failures (diff) | |
download | linux-b01537bfbc832a09162e7189f63251a8785e2112.tar.xz linux-b01537bfbc832a09162e7189f63251a8785e2112.zip |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull vfs dentry reference count fix from Al Viro.
This fixes a possible inode_permission NULL pointer dereference (and
other problems) that were due to the root dentry count being decremented
too much. In commit 48a066e72d97 ("RCU'd vfsmounts") the placement of
clearing the LOOKUP_RCU bit changed, and we then returned failure of
incrementing the lockref on the parent dentry with LOOKUP_RCU cleared.
But that meant we needed to go through the same cleanup routines that
the later failures did wrt LOOKUP_ROOT and nd->root.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
fix bogus path_put() of nd->root after some unlazy_walk() failures
Diffstat (limited to 'fs')
-rw-r--r-- | fs/namei.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/fs/namei.c b/fs/namei.c index 8f77a8cea289..c53d3a9547f9 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -513,8 +513,7 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry) if (!lockref_get_not_dead(&parent->d_lockref)) { nd->path.dentry = NULL; - rcu_read_unlock(); - return -ECHILD; + goto out; } /* |