cifs: cope with negative dentries in cifs_get_root
authorJeff Layton <jlayton@redhat.com>
Fri, 5 Aug 2011 13:02:40 +0000 (09:02 -0400)
committerSteve French <sfrench@us.ibm.com>
Fri, 5 Aug 2011 15:03:09 +0000 (15:03 +0000)
The loop around lookup_one_len doesn't handle the case where it might
return a negative dentry, which can cause an oops on the next pass
through the loop. Check for that and break out of the loop with an
error of -ENOENT if there is one.

Fixes the panic reported here:

    https://bugzilla.redhat.com/show_bug.cgi?id=727927

Reported-by: TR Bentley <home@trarbentley.net>
Reported-by: Iain Arnell <iarnell@gmail.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Cc: stable@kernel.org
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
fs/cifs/cifsfs.c

index 212e5629cc1d01880263aaa6f0b12ef6a1a46291..f93eb948d0716203b96a23f619866ce50678cada 100644 (file)
@@ -563,6 +563,10 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                mutex_unlock(&dir->i_mutex);
                dput(dentry);
                dentry = child;
                mutex_unlock(&dir->i_mutex);
                dput(dentry);
                dentry = child;
+               if (!dentry->d_inode) {
+                       dput(dentry);
+                       dentry = ERR_PTR(-ENOENT);
+               }
        } while (!IS_ERR(dentry));
        _FreeXid(xid);
        kfree(full_path);
        } while (!IS_ERR(dentry));
        _FreeXid(xid);
        kfree(full_path);