| commit | d4565649b6d6923369112758212b851adc407f0c | [log] [tgz] |
|---|---|---|
| author | Al Viro <viro@zeniv.linux.org.uk> | Sat Feb 27 19:23:16 2016 -0500 |
| committer | Al Viro <viro@zeniv.linux.org.uk> | Sat Feb 27 19:23:16 2016 -0500 |
| tree | fc877b8805e9393c4288bdf396cf223de2b144ad | |
| parent | c80567c82ae4814a41287618e315a60ecf513be6 [diff] |
namei: ->d_inode of a pinned dentry is stable only for positives both do_last() and walk_component() risk picking a NULL inode out of dentry about to become positive, *then* checking its flags and seeing that it's not negative anymore and using (already stale by then) value they'd fetched earlier. Usually ends up oopsing soon after that... Cc: stable@vger.kernel.org # v3.13+ Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>