3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jeff Layton <jlay...@redhat.com>
commit 80975d21aae2136ccae1ce914a1602dc1d8b0795 upstream.
The loop around lookup_one_len doesn't handle the case where it might
return a negative dentry, which can cause an oops on the next pass
through the loop. Check for that and break out of the loop with an
error of -ENOENT if there is one.
Fixes the panic reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=727927
Reported-by: TR Bentley <h...@trarbentley.net>
Reported-by: Iain Arnell <iarn...@gmail.com>
Cc: Al Viro <v...@zeniv.linux.org.uk>
Signed-off-by: Jeff Layton <jlay...@redhat.com>
Signed-off-by: Steve French <sfre...@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---
fs/cifs/cifsfs.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -581,6 +581,10 @@ cifs_get_root(struct smb_vol *vol, struc
mutex_unlock(&dir->i_mutex);
dput(dentry);
dentry = child;
+ if (!dentry->d_inode) {
+ dput(dentry);
+ dentry = ERR_PTR(-ENOENT);
+ }
} while (!IS_ERR(dentry));
_FreeXid(xid);
kfree(full_path);
_______________________________________________
stable mailing list
stable@linux.kernel.org
http://linux.kernel.org/mailman/listinfo/stable
