Re: fs: NULL deref in atime_needs_update

[Al Viro]

On Sat, Feb 20, 2016 at 09:26:28PM +0100, Mickaël Salaün wrote:
> > +	if (unlikely(error > 0)) {
> > +		WARN_ON(1);
> > +		error = -EINVAL;
> > +	}
> >  	if (got_write)
> >  		mnt_drop_write(nd->path.mnt);
> >  	path_put(&save_parent);
> > 
> 
> I think your warning patch should be upstreamed to detect such cases :)

I'm not sure whether it's better done there or one step closer to the
source - e.g. telling whether it was bogus ->open() or a bogus LSM hook
(and _which_ bogus LSM hook had it been) would be hard with that location
of test.

It still leaves the question of what's going on in Dmitry's tests - it might
be one of those source or it might be something else entirely; this location
of test would at least tell whether a stack underrun is involved or not...