From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-fsdevel-owner@vger.kernel.org>
Received: from mx1.redhat.com ([209.132.183.28]:34984 "EHLO mx1.redhat.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1752591AbdBUQGw (ORCPT <rfc822;linux-fsdevel@vger.kernel.org>);
        Tue, 21 Feb 2017 11:06:52 -0500
Date: Tue, 21 Feb 2017 11:06:49 -0500
From: Vivek Goyal <vgoyal@redhat.com>
To: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Djalal Harouni <tixxdz@gmail.com>, Chris Mason <clm@fb.com>,
        Theodore Tso <tytso@mit.edu>,
        Josh Triplett <josh@joshtriplett.org>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        Andy Lutomirski <luto@kernel.org>,
        Seth Forshee <seth.forshee@canonical.com>,
        linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        Dongsu Park <dongsu@endocode.com>,
        David Herrmann <dh.herrmann@googlemail.com>,
        Miklos Szeredi <mszeredi@redhat.com>,
        Alban Crequy <alban.crequy@gmail.com>,
        Al Viro <viro@ZenIV.linux.org.uk>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        Phil Estes <estesp@gmail.com>,
        Amir Goldstein <amir73il@gmail.com>
Subject: Re: [RFC v2 1/1] shiftfs: uid/gid shifting bind mount
Message-ID: <20170221160649.GC28653@redhat.com>
References: <1487637902.2337.47.camel@HansenPartnership.com>
 <1487638025.2337.49.camel@HansenPartnership.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1487638025.2337.49.camel@HansenPartnership.com>
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

On Mon, Feb 20, 2017 at 04:47:05PM -0800, James Bottomley wrote:

[..]
> +static struct dentry *shiftfs_lookup(struct inode *dir, struct dentry *dentry,
> +				     unsigned int flags)
> +{
> +	struct dentry *real = dir->i_private, *new;
> +	struct inode *reali = real->d_inode, *newi;

newi needs to be initialized to NULL. Otherwise if a file does not
exist, we try to call d_splice_alias() with uninitialized value of newi.

This crashes for the new file creation case.

Vivek