Commit b403f0e3 authored by Miklos Szeredi's avatar Miklos Szeredi Committed by Al Viro

9p: use file_dentry()

v9fs may be used as lower layer of overlayfs and accessing f_path.dentry
can lead to a crash.  In this case it's a NULL pointer dereference in
p9_fid_create().

Fix by replacing direct access of file->f_path.dentry with the
file_dentry() accessor, which will always return a native object.
Reported-by: default avatarAlessio Igor Bogani <alessioigorbogani@gmail.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
Tested-by: default avatarAlessio Igor Bogani <alessioigorbogani@gmail.com>
Fixes: 4bacc9c9 ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent b42b90d1
...@@ -74,7 +74,7 @@ int v9fs_file_open(struct inode *inode, struct file *file) ...@@ -74,7 +74,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
v9fs_proto_dotu(v9ses)); v9fs_proto_dotu(v9ses));
fid = file->private_data; fid = file->private_data;
if (!fid) { if (!fid) {
fid = v9fs_fid_clone(file->f_path.dentry); fid = v9fs_fid_clone(file_dentry(file));
if (IS_ERR(fid)) if (IS_ERR(fid))
return PTR_ERR(fid); return PTR_ERR(fid);
...@@ -100,7 +100,7 @@ int v9fs_file_open(struct inode *inode, struct file *file) ...@@ -100,7 +100,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
* because we want write after unlink usecase * because we want write after unlink usecase
* to work. * to work.
*/ */
fid = v9fs_writeback_fid(file->f_path.dentry); fid = v9fs_writeback_fid(file_dentry(file));
if (IS_ERR(fid)) { if (IS_ERR(fid)) {
err = PTR_ERR(fid); err = PTR_ERR(fid);
mutex_unlock(&v9inode->v_mutex); mutex_unlock(&v9inode->v_mutex);
...@@ -516,7 +516,7 @@ v9fs_mmap_file_mmap(struct file *filp, struct vm_area_struct *vma) ...@@ -516,7 +516,7 @@ v9fs_mmap_file_mmap(struct file *filp, struct vm_area_struct *vma)
* because we want write after unlink usecase * because we want write after unlink usecase
* to work. * to work.
*/ */
fid = v9fs_writeback_fid(filp->f_path.dentry); fid = v9fs_writeback_fid(file_dentry(filp));
if (IS_ERR(fid)) { if (IS_ERR(fid)) {
retval = PTR_ERR(fid); retval = PTR_ERR(fid);
mutex_unlock(&v9inode->v_mutex); mutex_unlock(&v9inode->v_mutex);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment