Commit 077130c0 authored by Eric W. Biederman's avatar Eric W. Biederman Committed by David S. Miller
Browse files

[NET]: Fix race when opening a proc file while a network namespace is exiting. 



The problem:  proc_net files remember which network namespace the are
against but do not remember hold a reference count (as that would pin
the network namespace).   So we currently have a small window where
the reference count on a network namespace may be incremented when opening
a /proc file when it has already gone to zero.

To fix this introduce maybe_get_net and get_proc_net.

maybe_get_net increments the network namespace reference count only if it is
greater then zero, ensuring we don't increment a reference count after it
has gone to zero.

get_proc_net handles all of the magic to go from a proc inode to the network
namespace instance and call maybe_get_net on it.

PROC_NET the old accessor is removed so that we don't get confused and use
the wrong helper function.

Then I fix up the callers to use get_proc_net and handle the case case
where get_proc_net returns NULL.  In that case I return -ENXIO because
effectively the network namespace has already gone away so the files
we are trying to access don't exist anymore.

Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
Acked-by: default avatarPaul E. McKenney <paulmck@us.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4fabcd71

fs/proc/proc_net.c

+6 −0
Original line number Diff line number Diff line
@@ -51,6 +51,12 @@ void proc_net_remove(struct net *net, const char *name) 
}

EXPORT_SYMBOL_GPL(proc_net_remove);



struct net *get_proc_net(const struct inode *inode)

{

	return maybe_get_net(PDE_NET(PDE(inode)));

}

EXPORT_SYMBOL_GPL(get_proc_net);



static struct proc_dir_entry *proc_net_shadow;



static struct dentry *proc_net_shadow_dentry(struct dentry *parent,

include/linux/proc_fs.h

+1 −4
Original line number Diff line number Diff line
@@ -270,10 +270,7 @@ static inline struct net *PDE_NET(struct proc_dir_entry *pde) 
	return pde->parent->data;

}



static inline struct net *PROC_NET(const struct inode *inode)

{

	return PDE_NET(PDE(inode));

}

struct net *get_proc_net(const struct inode *inode);



struct proc_maps_private {

	struct pid *pid;

include/net/net_namespace.h

+12 −0
Original line number Diff line number Diff line
@@ -46,6 +46,18 @@ static inline struct net *get_net(struct net *net) 
	return net;

}



static inline struct net *maybe_get_net(struct net *net)

{

	/* Used when we know struct net exists but we

	 * aren't guaranteed a previous reference count

	 * exists.  If the reference count is zero this

	 * function fails and returns NULL.

	 */

	if (!atomic_inc_not_zero(&net->count))

		net = NULL;

	return net;

}



static inline void put_net(struct net *net)

{

	if (atomic_dec_and_test(&net->count))

net/core/dev.c

+5 −1
Original line number Diff line number Diff line
@@ -2464,7 +2464,11 @@ static int dev_seq_open(struct inode *inode, struct file *file) 
	res =  seq_open(file, &dev_seq_ops);

	if (!res) {

		seq = file->private_data;

		seq->private = get_net(PROC_NET(inode));

		seq->private = get_proc_net(inode);

		if (!seq->private) {

			seq_release(inode, file);

			res = -ENXIO;

		}

	}

	return res;

}

net/core/dev_mcast.c

+5 −1
Original line number Diff line number Diff line
@@ -246,7 +246,11 @@ static int dev_mc_seq_open(struct inode *inode, struct file *file) 
	res = seq_open(file, &dev_mc_seq_ops);

	if (!res) {

		seq = file->private_data;

		seq->private = get_net(PROC_NET(inode));

		seq->private = get_proc_net(inode);

		if (!seq->private) {

			seq_release(inode, file);

			res = -ENXIO;

		}

	}

	return res;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE