Messages in this thread | | | Date | Thu, 12 Jun 2014 11:43:14 +0100 | From | Al Viro <> | Subject | Re: [RFC][PATCH] debugfs: Fix corrupted loop in debugfs_remove_recursive |
| |
On Mon, Jun 09, 2014 at 02:06:07PM -0400, Steven Rostedt wrote:
> When these are called, the d_entry and inode locks need to be released > to call the instance creation and deletion code. That code has its own > accounting and locking to serialize everything to prevent multiple > users from causing harm. As the parent "instance" directory can not > be modified this simplifies things.
Yecchhh... Looking at debugfs:
static inline int debugfs_positive(struct dentry *dentry) { return dentry->d_inode && !d_unhashed(dentry); }
... if (debugfs_positive(dentry)) { if (dentry->d_inode) { What the hell?
parent = dentry->d_parent; if (!parent || !parent->d_inode) return; Huh? First of all, ->d_parent is *never* NULL. Moreover, it can't be a negative dentry.
What's more, if debugfs_rename() is ever used for cross-directory renames, this tree-walker is buggered - it'll happily walk up "back" into a directory it has never visited...
| |