mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-11-04 09:44:14 -05:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
9c2d205664
When calling vfs_unlink() on the lower dentry, d_delete() turns the
dentry into a negative dentry when the d_count is 1. This eventually
caused a NULL pointer deref when a read() or write() was done and the
negative dentry's d_inode was dereferenced in
ecryptfs_read_update_atime() or ecryptfs_getxattr().
Placing mutt's tmpdir in an eCryptfs mount is what initially triggered
the oops and I was able to reproduce it with the following sequence:
open("/tmp/upper/foo", O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW, 0600) = 3
link("/tmp/upper/foo", "/tmp/upper/bar") = 0
unlink("/tmp/upper/foo") = 0
open("/tmp/upper/bar", O_RDWR|O_CREAT|O_NOFOLLOW, 0600) = 4
unlink("/tmp/upper/bar") = 0
write(4, "eCryptfs test\n"..., 14 <unfinished ...>
+++ killed by SIGKILL +++
https://bugs.launchpad.net/ecryptfs/+bug/387073
Reported-by: Loïc Minier <[email protected]>
Cc: Serge Hallyn <[email protected]>
Cc: Dave Kleikamp <[email protected]>
Cc: [email protected]
Cc: stable <[email protected]>
Signed-off-by: Tyler Hicks <[email protected]>
|
||
| .. | ||
| crypto.c | ||
| debug.c | ||
| dentry.c | ||
| ecryptfs_kernel.h | ||
| file.c | ||
| inode.c | ||
| Kconfig | ||
| keystore.c | ||
| kthread.c | ||
| main.c | ||
| Makefile | ||
| messaging.c | ||
| miscdev.c | ||
| mmap.c | ||
| read_write.c | ||
| super.c | ||