Re: inode_permission NULL pointer dereference in 3.13-rc1

Christoph Hellwig
2013-11-25T16:07:01Z

On Sun, Nov 24, 2013 at 03:27:58PM +0000, Al Viro wrote:
> which seems to leave two candidates - follow_dotdot_rcu() and path_init(),
> both setting nd->inode to nd->path.dentry->d_inode...
>
> Could you try to reproduce it with something like
> if (read_seqretry(&mount_lock, nd->m_seq))
> goto failed;
> slapped before the success exit in follow_dotdot_rcu(), just to see if
> we are hitting some races with umount here?

Still reproducable with the diff below. Fixed by reverting the RCU'd
vfsmounts.

diff --git a/fs/namei.c b/fs/namei.c
index 8f77a8c..856e4d5 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1158,6 +1158,10 @@ static int follow_dotdot_rcu(struct nameidata *nd)
}
follow_mount_rcu(nd);
nd->inode = nd->path.dentry->d_inode;
+
+ if (read_seqretry(&mount_lock, nd->m_seq))
+ goto failed;
+
return 0;