public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Trond Myklebust <trond.myklebust@fys.uio.no>
To: Jesper Juhl <jesper.juhl@gmail.com>
Cc: linux-kernel@vger.kernel.org, Rick Sladkey <jrs@world.std.com>,
	Neil Brown <neilb@cse.unsw.edu.au>,
	nfs@lists.sourceforge.net
Subject: Re: [PATCH] NFS: possible NULL pointer deref in nfs_sillyrename()
Date: Wed, 16 Aug 2006 20:16:41 -0400	[thread overview]
Message-ID: <1155773801.6739.5.camel@localhost> (raw)
In-Reply-To: <200608170022.29168.jesper.juhl@gmail.com>

On Thu, 2006-08-17 at 00:22 +0200, Jesper Juhl wrote:
> The coverity checker spotted this as bug #1013.
> 
> If we get a NULL dentry->d_inode, then regardless of 
> NFS_PARANOIA or no NFS_PARANOIA, then if 
>    if (dentry->d_flags & DCACHE_NFSFS_RENAMED)
> turns out to be false we'll end up dereferencing 
> that NULL d_inode in two places below.
> 
> And since the check for "(!dentry->d_inode)" even exists
> (although inside #ifdef NFS_PARANOIA) I take that to mean
> that this is a possibility. 

Sorry, but it isn't possible. See the checks in may_delete() (which is
called before ->unlink()) and nfs_rename().

IOW: Feel free to kill the NFS_PARANOIA crap. It looks like legacy code
from a debugging session about a decade or so ago.

Cheers,
  Trond


  reply	other threads:[~2006-08-17  0:16 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2006-08-16 22:22 [PATCH] NFS: possible NULL pointer deref in nfs_sillyrename() Jesper Juhl
2006-08-17  0:16 ` Trond Myklebust [this message]
2006-08-17 10:05   ` Jesper Juhl
2006-09-19  0:25     ` Kill NFS_PARANOIA (was: Re: [PATCH] NFS: possible NULL pointer deref in nfs_sillyrename() ) Jesper Juhl

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1155773801.6739.5.camel@localhost \
    --to=trond.myklebust@fys.uio.no \
    --cc=jesper.juhl@gmail.com \
    --cc=jrs@world.std.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=neilb@cse.unsw.edu.au \
    --cc=nfs@lists.sourceforge.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox