[PATCH vfs/for-next] fs/dcache.c: fix NULL pointer dereference in shrink_lock_dentry()

[Eric Biggers <ebiggers3@gmail.com>]

From: Eric Biggers <ebiggers@google.com>

We can reach 'out:' with a negative dentry, e.g. if there is contention
on ->d_parent->d_lock and another task concurrently gets a reference to
the negative dentry.  In that case 'inode' will be NULL, so we must not
try to unlock 'inode'.

This bug was found by xfstest generic/429.

Fixes: 121a8e083486 ("get rid of trylock loop in locking dentries on shrink list")
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 fs/dcache.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/dcache.c b/fs/dcache.c
index 0c78ef4bb5e7..c159a4b304cf 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1028,7 +1028,8 @@ static bool shrink_lock_dentry(struct dentry *dentry)
 		return true;
 	spin_unlock(&parent->d_lock);
 out:
-	spin_unlock(&inode->i_lock);
+	if (inode)
+		spin_unlock(&inode->i_lock);
 	return false;
 }
 
-- 
2.17.0.rc0.231.g781580f067-goog