From: Miklos Szeredi <miklos@szeredi.hu>
Date: Tue, 4 Nov 2014 15:11:03 +0000 (+0100)
Subject: ovl: don't poison cursor
X-Git-Tag: v3.18-rc6~8^2~5
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=3f822c6264954660babce757fb45792fd3af273e;p=profile%2Fcommon%2Fplatform%2Fkernel%2Flinux-artik7.git

ovl: don't poison cursor

ovl_cache_put() can be called from ovl_dir_reset() if the cache needs to be
rebuilt.  We did list_del() on the cursor, which results in an Oops on the
poisoned pointer in ovl_seek_cursor().

Reported-by: Jordi Pujol Palomer <jordipujolp@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Tested-by: Jordi Pujol Palomer <jordipujolp@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 4e9d7c1..2a7ef4f 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -168,7 +168,7 @@ static void ovl_cache_put(struct ovl_dir_file *od, struct dentry *dentry)
 {
 	struct ovl_dir_cache *cache = od->cache;
 
-	list_del(&od->cursor.l_node);
+	list_del_init(&od->cursor.l_node);
 	WARN_ON(cache->refcount <= 0);
 	cache->refcount--;
 	if (!cache->refcount) {