Unverified Commit 0307d16f authored by David Howells's avatar David Howells Committed by Christian Brauner
Browse files

afs: Fix afs_atcell_get_link() to check if ws_cell is unset first 



Fix afs_atcell_get_link() to check if the workstation cell is unset before
doing the RCU pathwalk bit where we dereference that.

Fixes: 823869e1 ("afs: Fix afs_atcell_get_link() to handle RCU pathwalk")
Reported-by: default avatar <syzbot+76a6f18e3af82e84f264@syzkaller.appspotmail.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/2481796.1742296819@warthog.procyon.org.uk


Tested-by: default avatar <syzbot+76a6f18e3af82e84f264@syzkaller.appspotmail.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 4701f33a

fs/afs/dynroot.c

+3 −3
Original line number Diff line number Diff line
@@ -314,6 +314,9 @@ static const char *afs_atcell_get_link(struct dentry *dentry, struct inode *inod 
	const char *name;

	bool dotted = vnode->fid.vnode == 3;



	if (!rcu_access_pointer(net->ws_cell))

		return ERR_PTR(-ENOENT);



	if (!dentry) {

		/* We're in RCU-pathwalk. */

		cell = rcu_dereference(net->ws_cell);
@@ -325,9 +328,6 @@ static const char *afs_atcell_get_link(struct dentry *dentry, struct inode *inod 
		return name;

	}



	if (!rcu_access_pointer(net->ws_cell))

		return ERR_PTR(-ENOENT);



	down_read(&net->cells_lock);



	cell = rcu_dereference_protected(net->ws_cell, lockdep_is_held(&net->cells_lock));