evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ovl: don't poison cursor

Browse source 
ovl_cache_put() can be called from ovl_dir_reset() if the cache needs to be
rebuilt.  We did list_del() on the cursor, which results in an Oops on the
poisoned pointer in ovl_seek_cursor().

Reported-by: Jordi Pujol Palomer <jordipujolp@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Tested-by: Jordi Pujol Palomer <jordipujolp@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Miklos Szeredi 2014-11-04 16:11:03 +01:00 • committed by Al Viro
parent a1cff6e25e
commit 3f822c6264
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
fs/overlayfs/readdir.c
View file

@ -168,7 +168,7 @@ static void ovl_cache_put(struct ovl_dir_file *od, struct dentry *dentry)
{ {
struct ovl_dir_cache *cache = od->cache; struct ovl_dir_cache *cache = od->cache;
list_del(&od->cursor.l_node); list_del_init(&od->cursor.l_node);
WARN_ON(cache->refcount <= 0); WARN_ON(cache->refcount <= 0);
cache->refcount--; cache->refcount--;
if (!cache->refcount) { if (!cache->refcount) {