[Unionfs] NULL pointer dereference if copyup_dentry() failed?

[Erez Zadok]

In message <200809211616.CHH52682.HSJFOFtOLFVQOM at I-love.SAKURA.ne.jp>, Tetsuo Handa writes:
> Hello.
> 
> I tried 2.6.27-rc6 + unionfs 2.5 , but this problem is remaining.

OK thanks for the report.  Tetsuo, are the instructions you gave me before
for reproducing this w/ TOMOYO the same, or have the instructions changed?
If they've changed, can you give me an updated set of instrux?

> Regards.

Could you add this small patch below and let me know if the BUG_ON triggers?
Given your stack trace, I'm suspecting that somehow the lower dentry isn't
instantiated w/ an inode perhaps.

Thanks,
Erez.


diff --git a/fs/unionfs/inode.c b/fs/unionfs/inode.c
index 800648e..76f20de 100644
--- a/fs/unionfs/inode.c
+++ b/fs/unionfs/inode.c
@@ -964,6 +964,7 @@ static int unionfs_setattr(struct dentry *dentry, struct iattr *ia)
 
 	/* notify the (possibly copied-up) lower inode */
 	mutex_lock(&lower_inode->i_mutex);
+	BUG_ON(!lower_dentry->d_inode);
 	err = notify_change(lower_dentry, ia);
 	mutex_unlock(&lower_inode->i_mutex);
 	if (err)