ovl: don't poison cursor
authorMiklos Szeredi <miklos@szeredi.hu>
Tue, 4 Nov 2014 15:11:03 +0000 (16:11 +0100)
committerAl Viro <viro@zeniv.linux.org.uk>
Wed, 5 Nov 2014 13:49:38 +0000 (08:49 -0500)
ovl_cache_put() can be called from ovl_dir_reset() if the cache needs to be
rebuilt.  We did list_del() on the cursor, which results in an Oops on the
poisoned pointer in ovl_seek_cursor().

Reported-by: Jordi Pujol Palomer <jordipujolp@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Tested-by: Jordi Pujol Palomer <jordipujolp@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/overlayfs/readdir.c

index 4e9d7c1fea52a98b85e8c3ce04c792b07ef4377a..2a7ef4f8e2a6c37e033b771413fc66f75b567556 100644 (file)
@@ -168,7 +168,7 @@ static void ovl_cache_put(struct ovl_dir_file *od, struct dentry *dentry)
 {
        struct ovl_dir_cache *cache = od->cache;
 
-       list_del(&od->cursor.l_node);
+       list_del_init(&od->cursor.l_node);
        WARN_ON(cache->refcount <= 0);
        cache->refcount--;
        if (!cache->refcount) {