<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/fs/ecryptfs/inode.c, branch v4.4.93</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>fs: Drop unlikely before IS_ERR(_OR_NULL)</title>
<updated>2015-09-29T13:13:58+00:00</updated>
<author>
<name>Viresh Kumar</name>
<email>viresh.kumar@linaro.org</email>
</author>
<published>2015-08-12T10:29:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a1c83681d52704c766d576bea2d7f2f99e8dde23'/>
<id>a1c83681d52704c766d576bea2d7f2f99e8dde23</id>
<content type='text'>
IS_ERR(_OR_NULL) already contain an 'unlikely' compiler flag and there
is no need to do that again from its callers. Drop it.

Signed-off-by: Viresh Kumar &lt;viresh.kumar@linaro.org&gt;
Reviewed-by: Jeff Layton &lt;jlayton@poochiereds.net&gt;
Reviewed-by: David Howells &lt;dhowells@redhat.com&gt;
Reviewed-by: Steve French &lt;smfrench@gmail.com&gt;
Signed-off-by: Jiri Kosina &lt;jkosina@suse.cz&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
IS_ERR(_OR_NULL) already contain an 'unlikely' compiler flag and there
is no need to do that again from its callers. Drop it.

Signed-off-by: Viresh Kumar &lt;viresh.kumar@linaro.org&gt;
Reviewed-by: Jeff Layton &lt;jlayton@poochiereds.net&gt;
Reviewed-by: David Howells &lt;dhowells@redhat.com&gt;
Reviewed-by: Steve French &lt;smfrench@gmail.com&gt;
Signed-off-by: Jiri Kosina &lt;jkosina@suse.cz&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>get rid of assorted nameidata-related debris</title>
<updated>2015-05-15T05:10:37+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2015-05-12T12:29:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=89076bc31950eee576ecc06460c23466e2d50939'/>
<id>89076bc31950eee576ecc06460c23466e2d50939</id>
<content type='text'>
pointless forward declarations, stale comments

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
pointless forward declarations, stale comments

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>don't pass nameidata to -&gt;follow_link()</title>
<updated>2015-05-11T02:20:15+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2015-05-02T17:37:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6e77137b363b8d866ac29c5a0c95e953614fb2d8'/>
<id>6e77137b363b8d866ac29c5a0c95e953614fb2d8</id>
<content type='text'>
its only use is getting passed to nd_jump_link(), which can obtain
it from current-&gt;nameidata

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
its only use is getting passed to nd_jump_link(), which can obtain
it from current-&gt;nameidata

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>new -&gt;follow_link() and -&gt;put_link() calling conventions</title>
<updated>2015-05-11T02:19:45+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2015-05-02T17:32:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=680baacbca69d18a6d7315374ad83d05ac9c0977'/>
<id>680baacbca69d18a6d7315374ad83d05ac9c0977</id>
<content type='text'>
a) instead of storing the symlink body (via nd_set_link()) and returning
an opaque pointer later passed to -&gt;put_link(), -&gt;follow_link() _stores_
that opaque pointer (into void * passed by address by caller) and returns
the symlink body.  Returning ERR_PTR() on error, NULL on jump (procfs magic
symlinks) and pointer to symlink body for normal symlinks.  Stored pointer
is ignored in all cases except the last one.

Storing NULL for opaque pointer (or not storing it at all) means no call
of -&gt;put_link().

b) the body used to be passed to -&gt;put_link() implicitly (via nameidata).
Now only the opaque pointer is.  In the cases when we used the symlink body
to free stuff, -&gt;follow_link() now should store it as opaque pointer in addition
to returning it.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
a) instead of storing the symlink body (via nd_set_link()) and returning
an opaque pointer later passed to -&gt;put_link(), -&gt;follow_link() _stores_
that opaque pointer (into void * passed by address by caller) and returns
the symlink body.  Returning ERR_PTR() on error, NULL on jump (procfs magic
symlinks) and pointer to symlink body for normal symlinks.  Stored pointer
is ignored in all cases except the last one.

Storing NULL for opaque pointer (or not storing it at all) means no call
of -&gt;put_link().

b) the body used to be passed to -&gt;put_link() implicitly (via nameidata).
Now only the opaque pointer is.  In the cases when we used the symlink body
to free stuff, -&gt;follow_link() now should store it as opaque pointer in addition
to returning it.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>VFS: normal filesystems (and lustre): d_inode() annotations</title>
<updated>2015-04-15T19:06:57+00:00</updated>
<author>
<name>David Howells</name>
<email>dhowells@redhat.com</email>
</author>
<published>2015-03-17T22:25:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2b0143b5c986be1ce8408b3aadc4709e0a94429d'/>
<id>2b0143b5c986be1ce8408b3aadc4709e0a94429d</id>
<content type='text'>
that's the bulk of filesystem drivers dealing with inodes of their own

Signed-off-by: David Howells &lt;dhowells@redhat.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
that's the bulk of filesystem drivers dealing with inodes of their own

Signed-off-by: David Howells &lt;dhowells@redhat.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>VFS: (Scripted) Convert S_ISLNK/DIR/REG(dentry-&gt;d_inode) to d_is_*(dentry)</title>
<updated>2015-02-22T16:38:41+00:00</updated>
<author>
<name>David Howells</name>
<email>dhowells@redhat.com</email>
</author>
<published>2015-01-29T12:02:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e36cb0b89ce20b4f8786a57e8a6bc8476f577650'/>
<id>e36cb0b89ce20b4f8786a57e8a6bc8476f577650</id>
<content type='text'>
Convert the following where appropriate:

 (1) S_ISLNK(dentry-&gt;d_inode) to d_is_symlink(dentry).

 (2) S_ISREG(dentry-&gt;d_inode) to d_is_reg(dentry).

 (3) S_ISDIR(dentry-&gt;d_inode) to d_is_dir(dentry).  This is actually more
     complicated than it appears as some calls should be converted to
     d_can_lookup() instead.  The difference is whether the directory in
     question is a real dir with a -&gt;lookup op or whether it's a fake dir with
     a -&gt;d_automount op.

In some circumstances, we can subsume checks for dentry-&gt;d_inode not being
NULL into this, provided we the code isn't in a filesystem that expects
d_inode to be NULL if the dirent really *is* negative (ie. if we're going to
use d_inode() rather than d_backing_inode() to get the inode pointer).

Note that the dentry type field may be set to something other than
DCACHE_MISS_TYPE when d_inode is NULL in the case of unionmount, where the VFS
manages the fall-through from a negative dentry to a lower layer.  In such a
case, the dentry type of the negative union dentry is set to the same as the
type of the lower dentry.

However, if you know d_inode is not NULL at the call site, then you can use
the d_is_xxx() functions even in a filesystem.

There is one further complication: a 0,0 chardev dentry may be labelled
DCACHE_WHITEOUT_TYPE rather than DCACHE_SPECIAL_TYPE.  Strictly, this was
intended for special directory entry types that don't have attached inodes.

The following perl+coccinelle script was used:

use strict;

my @callers;
open($fd, 'git grep -l \'S_IS[A-Z].*-&gt;d_inode\' |') ||
    die "Can't grep for S_ISDIR and co. callers";
@callers = &lt;$fd&gt;;
close($fd);
unless (@callers) {
    print "No matches\n";
    exit(0);
}

my @cocci = (
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISLNK(E-&gt;d_inode-&gt;i_mode)',
    '+ d_is_symlink(E)',
    '',
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISDIR(E-&gt;d_inode-&gt;i_mode)',
    '+ d_is_dir(E)',
    '',
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISREG(E-&gt;d_inode-&gt;i_mode)',
    '+ d_is_reg(E)' );

my $coccifile = "tmp.sp.cocci";
open($fd, "&gt;$coccifile") || die $coccifile;
print($fd "$_\n") || die $coccifile foreach (@cocci);
close($fd);

foreach my $file (@callers) {
    chomp $file;
    print "Processing ", $file, "\n";
    system("spatch", "--sp-file", $coccifile, $file, "--in-place", "--no-show-diff") == 0 ||
	die "spatch failed";
}

[AV: overlayfs parts skipped]

Signed-off-by: David Howells &lt;dhowells@redhat.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Convert the following where appropriate:

 (1) S_ISLNK(dentry-&gt;d_inode) to d_is_symlink(dentry).

 (2) S_ISREG(dentry-&gt;d_inode) to d_is_reg(dentry).

 (3) S_ISDIR(dentry-&gt;d_inode) to d_is_dir(dentry).  This is actually more
     complicated than it appears as some calls should be converted to
     d_can_lookup() instead.  The difference is whether the directory in
     question is a real dir with a -&gt;lookup op or whether it's a fake dir with
     a -&gt;d_automount op.

In some circumstances, we can subsume checks for dentry-&gt;d_inode not being
NULL into this, provided we the code isn't in a filesystem that expects
d_inode to be NULL if the dirent really *is* negative (ie. if we're going to
use d_inode() rather than d_backing_inode() to get the inode pointer).

Note that the dentry type field may be set to something other than
DCACHE_MISS_TYPE when d_inode is NULL in the case of unionmount, where the VFS
manages the fall-through from a negative dentry to a lower layer.  In such a
case, the dentry type of the negative union dentry is set to the same as the
type of the lower dentry.

However, if you know d_inode is not NULL at the call site, then you can use
the d_is_xxx() functions even in a filesystem.

There is one further complication: a 0,0 chardev dentry may be labelled
DCACHE_WHITEOUT_TYPE rather than DCACHE_SPECIAL_TYPE.  Strictly, this was
intended for special directory entry types that don't have attached inodes.

The following perl+coccinelle script was used:

use strict;

my @callers;
open($fd, 'git grep -l \'S_IS[A-Z].*-&gt;d_inode\' |') ||
    die "Can't grep for S_ISDIR and co. callers";
@callers = &lt;$fd&gt;;
close($fd);
unless (@callers) {
    print "No matches\n";
    exit(0);
}

my @cocci = (
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISLNK(E-&gt;d_inode-&gt;i_mode)',
    '+ d_is_symlink(E)',
    '',
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISDIR(E-&gt;d_inode-&gt;i_mode)',
    '+ d_is_dir(E)',
    '',
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISREG(E-&gt;d_inode-&gt;i_mode)',
    '+ d_is_reg(E)' );

my $coccifile = "tmp.sp.cocci";
open($fd, "&gt;$coccifile") || die $coccifile;
print($fd "$_\n") || die $coccifile foreach (@cocci);
close($fd);

foreach my $file (@callers) {
    chomp $file;
    print "Processing ", $file, "\n";
    system("spatch", "--sp-file", $coccifile, $file, "--in-place", "--no-show-diff") == 0 ||
	die "spatch failed";
}

[AV: overlayfs parts skipped]

Signed-off-by: David Howells &lt;dhowells@redhat.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>fs: remove mapping-&gt;backing_dev_info</title>
<updated>2015-01-20T21:03:05+00:00</updated>
<author>
<name>Christoph Hellwig</name>
<email>hch@lst.de</email>
</author>
<published>2015-01-14T09:42:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b83ae6d421435c6204150300f1c25bfbd39cd62b'/>
<id>b83ae6d421435c6204150300f1c25bfbd39cd62b</id>
<content type='text'>
Now that we never use the backing_dev_info pointer in struct address_space
we can simply remove it and save 4 to 8 bytes in every inode.

Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
Acked-by: Ryusuke Konishi &lt;konishi.ryusuke@lab.ntt.co.jp&gt;
Reviewed-by: Tejun Heo &lt;tj@kernel.org&gt;
Reviewed-by: Jan Kara &lt;jack@suse.cz&gt;
Signed-off-by: Jens Axboe &lt;axboe@fb.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Now that we never use the backing_dev_info pointer in struct address_space
we can simply remove it and save 4 to 8 bytes in every inode.

Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
Acked-by: Ryusuke Konishi &lt;konishi.ryusuke@lab.ntt.co.jp&gt;
Reviewed-by: Tejun Heo &lt;tj@kernel.org&gt;
Reviewed-by: Jan Kara &lt;jack@suse.cz&gt;
Signed-off-by: Jens Axboe &lt;axboe@fb.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'ecryptfs-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs</title>
<updated>2014-10-11T12:01:27+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2014-10-11T12:01:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=eca9fdf32dd48976eab18d310acb0b8d4cc9bf26'/>
<id>eca9fdf32dd48976eab18d310acb0b8d4cc9bf26</id>
<content type='text'>
Pull eCryptfs updates from Tyler Hicks:
 "Minor code cleanups and a fix for when eCryptfs metadata is stored in
  xattrs"

* tag 'ecryptfs-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
  ecryptfs: remove unneeded buggy code in ecryptfs_do_create()
  ecryptfs: avoid to access NULL pointer when write metadata in xattr
  ecryptfs: remove unnecessary break after goto
  ecryptfs: Remove unnecessary include of syscall.h in keystore.c
  fs/ecryptfs/messaging.c: remove null test before kfree
  ecryptfs: Drop cast
  Use %pd in eCryptFS
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull eCryptfs updates from Tyler Hicks:
 "Minor code cleanups and a fix for when eCryptfs metadata is stored in
  xattrs"

* tag 'ecryptfs-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
  ecryptfs: remove unneeded buggy code in ecryptfs_do_create()
  ecryptfs: avoid to access NULL pointer when write metadata in xattr
  ecryptfs: remove unnecessary break after goto
  ecryptfs: Remove unnecessary include of syscall.h in keystore.c
  fs/ecryptfs/messaging.c: remove null test before kfree
  ecryptfs: Drop cast
  Use %pd in eCryptFS
</pre>
</div>
</content>
</entry>
<entry>
<title>ecryptfs: remove unneeded buggy code in ecryptfs_do_create()</title>
<updated>2014-10-06T21:54:50+00:00</updated>
<author>
<name>Alexey Khoroshilov</name>
<email>khoroshilov@ispras.ru</email>
</author>
<published>2014-09-22T20:39:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0f9e2bf008a1b143973a01b52320eb66c20ac6ab'/>
<id>0f9e2bf008a1b143973a01b52320eb66c20ac6ab</id>
<content type='text'>
There is a bug in error handling of lock_parent() in ecryptfs_do_create():
lock_parent() acquries mutex even if dget_parent() fails, so mutex should be unlocked anyway.

But dget_parent() does not fail, so the patch just removes unneeded buggy code.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov &lt;khoroshilov@ispras.ru&gt;
Signed-off-by: Tyler Hicks &lt;tyhicks@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There is a bug in error handling of lock_parent() in ecryptfs_do_create():
lock_parent() acquries mutex even if dget_parent() fails, so mutex should be unlocked anyway.

But dget_parent() does not fail, so the patch just removes unneeded buggy code.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov &lt;khoroshilov@ispras.ru&gt;
Signed-off-by: Tyler Hicks &lt;tyhicks@canonical.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ecryptfs: avoid to access NULL pointer when write metadata in xattr</title>
<updated>2014-10-06T04:51:43+00:00</updated>
<author>
<name>Chao Yu</name>
<email>chao2.yu@samsung.com</email>
</author>
<published>2014-07-24T09:25:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=35425ea2492175fd39f6116481fe98b2b3ddd4ca'/>
<id>35425ea2492175fd39f6116481fe98b2b3ddd4ca</id>
<content type='text'>
Christopher Head 2014-06-28 05:26:20 UTC described:
"I tried to reproduce this on 3.12.21. Instead, when I do "echo hello &gt; foo"
in an ecryptfs mount with ecryptfs_xattr specified, I get a kernel crash:

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [&lt;ffffffff8110eb39&gt;] fsstack_copy_attr_all+0x2/0x61
PGD d7840067 PUD b2c3c067 PMD 0
Oops: 0002 [#1] SMP
Modules linked in: nvidia(PO)
CPU: 3 PID: 3566 Comm: bash Tainted: P           O 3.12.21-gentoo-r1 #2
Hardware name: ASUSTek Computer Inc. G60JX/G60JX, BIOS 206 03/15/2010
task: ffff8801948944c0 ti: ffff8800bad70000 task.ti: ffff8800bad70000
RIP: 0010:[&lt;ffffffff8110eb39&gt;]  [&lt;ffffffff8110eb39&gt;] fsstack_copy_attr_all+0x2/0x61
RSP: 0018:ffff8800bad71c10  EFLAGS: 00010246
RAX: 00000000000181a4 RBX: ffff880198648480 RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffff880172010450 RDI: 0000000000000000
RBP: ffff880198490e40 R08: 0000000000000000 R09: 0000000000000000
R10: ffff880172010450 R11: ffffea0002c51e80 R12: 0000000000002000
R13: 000000000000001a R14: 0000000000000000 R15: ffff880198490e40
FS:  00007ff224caa700(0000) GS:ffff88019fcc0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000bb07f000 CR4: 00000000000007e0
Stack:
ffffffff811826e8 ffff8800a39d8000 0000000000000000 000000000000001a
ffff8800a01d0000 ffff8800a39d8000 ffffffff81185fd5 ffffffff81082c2c
00000001a39d8000 53d0abbc98490e40 0000000000000037 ffff8800a39d8220
Call Trace:
[&lt;ffffffff811826e8&gt;] ? ecryptfs_setxattr+0x40/0x52
[&lt;ffffffff81185fd5&gt;] ? ecryptfs_write_metadata+0x1b3/0x223
[&lt;ffffffff81082c2c&gt;] ? should_resched+0x5/0x23
[&lt;ffffffff8118322b&gt;] ? ecryptfs_initialize_file+0xaf/0xd4
[&lt;ffffffff81183344&gt;] ? ecryptfs_create+0xf4/0x142
[&lt;ffffffff810f8c0d&gt;] ? vfs_create+0x48/0x71
[&lt;ffffffff810f9c86&gt;] ? do_last.isra.68+0x559/0x952
[&lt;ffffffff810f7ce7&gt;] ? link_path_walk+0xbd/0x458
[&lt;ffffffff810fa2a3&gt;] ? path_openat+0x224/0x472
[&lt;ffffffff810fa7bd&gt;] ? do_filp_open+0x2b/0x6f
[&lt;ffffffff81103606&gt;] ? __alloc_fd+0xd6/0xe7
[&lt;ffffffff810ee6ab&gt;] ? do_sys_open+0x65/0xe9
[&lt;ffffffff8157d022&gt;] ? system_call_fastpath+0x16/0x1b
RIP  [&lt;ffffffff8110eb39&gt;] fsstack_copy_attr_all+0x2/0x61
RSP &lt;ffff8800bad71c10&gt;
CR2: 0000000000000000
---[ end trace df9dba5f1ddb8565 ]---"

If we create a file when we mount with ecryptfs_xattr_metadata option, we will
encounter a crash in this path:
-&gt;ecryptfs_create
  -&gt;ecryptfs_initialize_file
    -&gt;ecryptfs_write_metadata
      -&gt;ecryptfs_write_metadata_to_xattr
        -&gt;ecryptfs_setxattr
          -&gt;fsstack_copy_attr_all
It's because our dentry-&gt;d_inode used in fsstack_copy_attr_all is NULL, and it
will be initialized when ecryptfs_initialize_file finish.

So we should skip copying attr from lower inode when the value of -&gt;d_inode is
invalid.

Signed-off-by: Chao Yu &lt;chao2.yu@samsung.com&gt;
Cc: stable@vger.kernel.org # v3.2+: b59db43 eCryptfs: Prevent file create race condition
Signed-off-by: Tyler Hicks &lt;tyhicks@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Christopher Head 2014-06-28 05:26:20 UTC described:
"I tried to reproduce this on 3.12.21. Instead, when I do "echo hello &gt; foo"
in an ecryptfs mount with ecryptfs_xattr specified, I get a kernel crash:

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [&lt;ffffffff8110eb39&gt;] fsstack_copy_attr_all+0x2/0x61
PGD d7840067 PUD b2c3c067 PMD 0
Oops: 0002 [#1] SMP
Modules linked in: nvidia(PO)
CPU: 3 PID: 3566 Comm: bash Tainted: P           O 3.12.21-gentoo-r1 #2
Hardware name: ASUSTek Computer Inc. G60JX/G60JX, BIOS 206 03/15/2010
task: ffff8801948944c0 ti: ffff8800bad70000 task.ti: ffff8800bad70000
RIP: 0010:[&lt;ffffffff8110eb39&gt;]  [&lt;ffffffff8110eb39&gt;] fsstack_copy_attr_all+0x2/0x61
RSP: 0018:ffff8800bad71c10  EFLAGS: 00010246
RAX: 00000000000181a4 RBX: ffff880198648480 RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffff880172010450 RDI: 0000000000000000
RBP: ffff880198490e40 R08: 0000000000000000 R09: 0000000000000000
R10: ffff880172010450 R11: ffffea0002c51e80 R12: 0000000000002000
R13: 000000000000001a R14: 0000000000000000 R15: ffff880198490e40
FS:  00007ff224caa700(0000) GS:ffff88019fcc0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000bb07f000 CR4: 00000000000007e0
Stack:
ffffffff811826e8 ffff8800a39d8000 0000000000000000 000000000000001a
ffff8800a01d0000 ffff8800a39d8000 ffffffff81185fd5 ffffffff81082c2c
00000001a39d8000 53d0abbc98490e40 0000000000000037 ffff8800a39d8220
Call Trace:
[&lt;ffffffff811826e8&gt;] ? ecryptfs_setxattr+0x40/0x52
[&lt;ffffffff81185fd5&gt;] ? ecryptfs_write_metadata+0x1b3/0x223
[&lt;ffffffff81082c2c&gt;] ? should_resched+0x5/0x23
[&lt;ffffffff8118322b&gt;] ? ecryptfs_initialize_file+0xaf/0xd4
[&lt;ffffffff81183344&gt;] ? ecryptfs_create+0xf4/0x142
[&lt;ffffffff810f8c0d&gt;] ? vfs_create+0x48/0x71
[&lt;ffffffff810f9c86&gt;] ? do_last.isra.68+0x559/0x952
[&lt;ffffffff810f7ce7&gt;] ? link_path_walk+0xbd/0x458
[&lt;ffffffff810fa2a3&gt;] ? path_openat+0x224/0x472
[&lt;ffffffff810fa7bd&gt;] ? do_filp_open+0x2b/0x6f
[&lt;ffffffff81103606&gt;] ? __alloc_fd+0xd6/0xe7
[&lt;ffffffff810ee6ab&gt;] ? do_sys_open+0x65/0xe9
[&lt;ffffffff8157d022&gt;] ? system_call_fastpath+0x16/0x1b
RIP  [&lt;ffffffff8110eb39&gt;] fsstack_copy_attr_all+0x2/0x61
RSP &lt;ffff8800bad71c10&gt;
CR2: 0000000000000000
---[ end trace df9dba5f1ddb8565 ]---"

If we create a file when we mount with ecryptfs_xattr_metadata option, we will
encounter a crash in this path:
-&gt;ecryptfs_create
  -&gt;ecryptfs_initialize_file
    -&gt;ecryptfs_write_metadata
      -&gt;ecryptfs_write_metadata_to_xattr
        -&gt;ecryptfs_setxattr
          -&gt;fsstack_copy_attr_all
It's because our dentry-&gt;d_inode used in fsstack_copy_attr_all is NULL, and it
will be initialized when ecryptfs_initialize_file finish.

So we should skip copying attr from lower inode when the value of -&gt;d_inode is
invalid.

Signed-off-by: Chao Yu &lt;chao2.yu@samsung.com&gt;
Cc: stable@vger.kernel.org # v3.2+: b59db43 eCryptfs: Prevent file create race condition
Signed-off-by: Tyler Hicks &lt;tyhicks@canonical.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
