From mboxrd@z Thu Jan  1 00:00:00 1970
From: Shaya Potter <spotter@cs.columbia.edu>
Subject: Re: Is a NULL check missing in nfs_lookup?
Date: Fri, 05 Jan 2007 10:00:22 -0500
Message-ID: <1168009222.29243.19.camel@localhost.localdomain>
References: <Pine.GSO.4.53.0701041855280.27384@compserv1>
	 <1167999770.6050.39.camel@lade.trondhjem.org>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Cc: Chaitanya Patti <crpatti@cs.sunysb.edu>,
	linux-fsdevel@vger.kernel.org
Return-path: <linux-fsdevel-owner@vger.kernel.org>
Received: from cs.columbia.edu ([128.59.16.20]:36714 "EHLO cs.columbia.edu"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1161116AbXAEPBI (ORCPT <rfc822;linux-fsdevel@vger.kernel.org>);
	Fri, 5 Jan 2007 10:01:08 -0500
To: Trond Myklebust <trond.myklebust@fys.uio.no>
In-Reply-To: <1167999770.6050.39.camel@lade.trondhjem.org>
Sender: linux-fsdevel-owner@vger.kernel.org
List-Id: linux-fsdevel.vger.kernel.org

On Fri, 2007-01-05 at 13:22 +0100, Trond Myklebust wrote:
> On Thu, 2007-01-04 at 19:00 -0500, Chaitanya Patti wrote:
> > 
> > Hello everyone,
> > 
> > In the function nfs_lookup in nfs/dir.c , the following line (line # 926):
> > 
> > error = nfs_reval_fsid(nd->mnt, dir, &fhandle, &fattr);
> > 
> > uses `nd' without having checked if it is NULL.
> > 
> > Is this correct?
> 
> It is quite intentional and correct. Calling ->lookup() without correct
> intent information is a bug.

I'd agree with you (And even told the person the problem up front)
except it's not oopsing on a lack of intent information, it's oopsing
because nd is null and therefore can not access nd->mnt.

i.e. Let say I couldn't reconstruct nd perfectly (due to not knowing
vfsmnt information), I could possible construct a fake nd with the
proper intent information (i.e. very likely no intent information to be
passed) and it would still oops.

So my question,

is changing nfs_reval_fsid() from

static inline int nfs_reval_fsid(struct vfsmount *mnt...)
	that calls __nfs_revalidate_inode(...., mnt->mnt_root->d_inode);

and is called as error = nfs_reval_fsid(nd->mnt...) by nfs_lookup()

to 

static inline int nfs_reval_fsid(struct dentry * dentry...)
	that calls __nfs_revalidate_inode(server, dentry->d_inode);

and is called as error = nfs_reval_fsid(dentry->d_sb->s_root...) by
nfs_lookup() 

incorrect?

now, it could be me missing the boat here, I wouldn't be surprised.

thanks.