Patch "ovl: check dentry positiveness in ovl_cleanup_whiteouts()" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

ovl: check dentry positiveness in ovl_cleanup_whiteouts()

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ovl-check-dentry-positiveness-in-ovl_cleanup_whiteouts.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Konstantin Khlebnikov <[email protected]>
Date: Mon, 16 Nov 2015 18:44:11 +0300
Subject: ovl: check dentry positiveness in ovl_cleanup_whiteouts()

From: Konstantin Khlebnikov <[email protected]>

commit 84889d49335627bc770b32787c1ef9ebad1da232 upstream.

This patch fixes kernel crash at removing directory which contains whiteouts from lower layers.

Cache of directory content passed as "list" contains entries from all layers, including whiteouts from lower layers. So, lookup in upper dir (moved into work at this stage) will return negative entry. Plus this cache is filled long before and we can race with external removal.

Example:
mkdir -p lower0/dir lower1/dir upper work overlay
touch lower0/dir/a lower0/dir/b
mknod lower1/dir/a c 0 0
mount -t overlay none overlay -o lowerdir=lower1:lower0,upperdir=upper,workdir=work rm -fr overlay/dir

---
 fs/overlayfs/readdir.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -571,7 +571,8 @@ void ovl_cleanup_whiteouts(struct dentry
 			       (int) PTR_ERR(dentry));
 			continue;
 		}
-		ovl_cleanup(upper->d_inode, dentry);
+		if (dentry->d_inode)
+			ovl_cleanup(upper->d_inode, dentry);
 		dput(dentry);
 	}
 	mutex_unlock(&upper->d_inode->i_mutex);

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/ovl-check-dentry-positiveness-in-ovl_cleanup_whiteouts.patch