[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <3982.1190638701@turing-police.cc.vt.edu>
Date: Mon, 24 Sep 2007 08:58:21 -0400
From: Valdis.Kletnieks@...edu
To: Christoph Hellwig <hch@...radead.org>,
Dave Hansen <haveblue@...ibm.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
linux-kernel@...r.kernel.org
Subject: Re: 2.6.23-rc7-mm1 - 'touch' command causes Oops.
On Mon, 24 Sep 2007 13:05:08 BST, Christoph Hellwig said:
> On Mon, Sep 24, 2007 at 06:35:50AM -0400, Valdis.Kletnieks@...edu wrote:
> > On Mon, 24 Sep 2007 02:17:16 PDT, Andrew Morton said:
> >
> > > ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.23-rc7/2.6.23-rc7-mm1/
> >
> > It lived fast, it died young, it didn't leave a pretty corpse...
(adding Dave Hansen to the cc: list, his patch added the mnt_want_write stuff)
> do_times passes an unitialized vfsmount into mnt_want_write. Here's
> the quick fix (untested), but the right fix is to restructure the complete
> mess do_utimes is (never let a libc developer write your kernel code.. :)):
Close - it still blew up, as one reference to nd.mnt remained. Fixed patch
is appended - system boots all the way with this applied.
--- linux-2.6.23-rc7-mm1/fs/utimes.c.dist 2007-09-24 05:57:38.000000000 -0400
+++ linux-2.6.23-rc7-mm1/fs/utimes.c 2007-09-24 08:48:34.000000000 -0400
@@ -59,6 +59,7 @@ long do_utimes(int dfd, char __user *fil
struct inode *inode;
struct iattr newattrs;
struct file *f = NULL;
+ struct vfsmount *mnt;
error = -EINVAL;
if (times && (!nsec_valid(times[0].tv_nsec) ||
@@ -79,17 +80,19 @@ long do_utimes(int dfd, char __user *fil
if (!f)
goto out;
dentry = f->f_path.dentry;
+ mnt = f->f_path.mnt;
} else {
error = __user_walk_fd(dfd, filename, (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW, &nd);
if (error)
goto out;
dentry = nd.dentry;
+ mnt = nd.mnt;
}
inode = dentry->d_inode;
- error = mnt_want_write(nd.mnt);
+ error = mnt_want_write(mnt);
if (error)
goto dput_and_out;
@@ -135,7 +138,7 @@ long do_utimes(int dfd, char __user *fil
error = notify_change(dentry, &newattrs);
mutex_unlock(&inode->i_mutex);
mnt_drop_write_and_out:
- mnt_drop_write(nd.mnt);
+ mnt_drop_write(mnt);
dput_and_out:
if (f)
fput(f);
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists