diff options
| author | Dominique Martinet <asmadeus@codewreck.org> | 2020-11-19 17:11:04 +0300 |
|---|---|---|
| committer | Dominique Martinet <asmadeus@codewreck.org> | 2020-11-19 19:22:28 +0300 |
| commit | 5bfe97d7382b5c1ec351c59a878e742c9fd73d38 (patch) | |
| tree | 62f7f3d4153845588970d4906272879c31a2c829 | |
| parent | ff5e72ebef41068789c93b0666cebde80cc8bd8c (diff) | |
| download | linux-5bfe97d7382b5c1ec351c59a878e742c9fd73d38.tar.xz | |
9p: Fix writeback fid incorrectly being attached to dentry
v9fs_dir_release needs fid->ilist to have been initialized for filp's
fid, not the inode's writeback fid's.
With refcounting this can be improved on later but this appears to fix
null deref issues.
Link: http://lkml.kernel.org/r/1605802012-31133-3-git-send-email-asmadeus@codewreck.org
Fixes: 6636b6dcc3db ("fs/9p: track open fids")
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
| -rw-r--r-- | fs/9p/vfs_file.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c index b0ef225cecd0..c5e49c88688d 100644 --- a/fs/9p/vfs_file.c +++ b/fs/9p/vfs_file.c @@ -46,7 +46,7 @@ int v9fs_file_open(struct inode *inode, struct file *file) int err; struct v9fs_inode *v9inode; struct v9fs_session_info *v9ses; - struct p9_fid *fid; + struct p9_fid *fid, *writeback_fid; int omode; p9_debug(P9_DEBUG_VFS, "inode: %p file: %p\n", inode, file); @@ -85,13 +85,13 @@ int v9fs_file_open(struct inode *inode, struct file *file) * because we want write after unlink usecase * to work. */ - fid = v9fs_writeback_fid(file_dentry(file)); + writeback_fid = v9fs_writeback_fid(file_dentry(file)); if (IS_ERR(fid)) { err = PTR_ERR(fid); mutex_unlock(&v9inode->v_mutex); goto out_error; } - v9inode->writeback_fid = (void *) fid; + v9inode->writeback_fid = (void *) writeback_fid; } mutex_unlock(&v9inode->v_mutex); if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) |