Commit 4ca6df13 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 

Pull sysctl fix from Eric Biederman:
 "A rather embarassing and hard to hit bug was merged into 4.11-rc1.

  Andrei Vagin tracked this bug now and after some staring at the code
  I came up with a fix"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  proc: Fix proc_sys_prune_dcache to hold a sb reference
parents edaf3825 2fd1d2c4

fs/proc/internal.h

+1 −1
Original line number Diff line number Diff line
@@ -67,7 +67,7 @@ struct proc_inode { 
	struct proc_dir_entry *pde;

	struct ctl_table_header *sysctl;

	struct ctl_table *sysctl_entry;

	struct list_head sysctl_inodes;

	struct hlist_node sysctl_inodes;

	const struct proc_ns_operations *ns_ops;

	struct inode vfs_inode;

};

fs/proc/proc_sysctl.c

+30 −13
Original line number Diff line number Diff line
@@ -191,7 +191,7 @@ static void init_header(struct ctl_table_header *head, 
	head->set = set;

	head->parent = NULL;

	head->node = node;

	INIT_LIST_HEAD(&head->inodes);

	INIT_HLIST_HEAD(&head->inodes);

	if (node) {

		struct ctl_table *entry;

		for (entry = table; entry->procname; entry++, node++)
@@ -261,25 +261,42 @@ static void unuse_table(struct ctl_table_header *p) 
			complete(p->unregistering);

}



/* called under sysctl_lock */

static void proc_sys_prune_dcache(struct ctl_table_header *head)

{

	struct inode *inode, *prev = NULL;

	struct inode *inode;

	struct proc_inode *ei;

	struct hlist_node *node;

	struct super_block *sb;



	rcu_read_lock();

	list_for_each_entry_rcu(ei, &head->inodes, sysctl_inodes) {

		inode = igrab(&ei->vfs_inode);

		if (inode) {

	for (;;) {

		node = hlist_first_rcu(&head->inodes);

		if (!node)

			break;

		ei = hlist_entry(node, struct proc_inode, sysctl_inodes);

		spin_lock(&sysctl_lock);

		hlist_del_init_rcu(&ei->sysctl_inodes);

		spin_unlock(&sysctl_lock);



		inode = &ei->vfs_inode;

		sb = inode->i_sb;

		if (!atomic_inc_not_zero(&sb->s_active))

			continue;

		inode = igrab(inode);

		rcu_read_unlock();

			iput(prev);

			prev = inode;

			d_prune_aliases(inode);

		if (unlikely(!inode)) {

			deactivate_super(sb);

			rcu_read_lock();

			continue;

		}



		d_prune_aliases(inode);

		iput(inode);

		deactivate_super(sb);



		rcu_read_lock();

	}

	rcu_read_unlock();

	iput(prev);

}



/* called under sysctl_lock, will reacquire if has to wait */
@@ -461,7 +478,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb, 
	}

	ei->sysctl = head;

	ei->sysctl_entry = table;

	list_add_rcu(&ei->sysctl_inodes, &head->inodes);

	hlist_add_head_rcu(&ei->sysctl_inodes, &head->inodes);

	head->count++;

	spin_unlock(&sysctl_lock);
@@ -489,7 +506,7 @@ out: 
void proc_sys_evict_inode(struct inode *inode, struct ctl_table_header *head)

{

	spin_lock(&sysctl_lock);

	list_del_rcu(&PROC_I(inode)->sysctl_inodes);

	hlist_del_init_rcu(&PROC_I(inode)->sysctl_inodes);

	if (!--head->count)

		kfree_rcu(head, rcu);

	spin_unlock(&sysctl_lock);

include/linux/sysctl.h

+1 −1
Original line number Diff line number Diff line
@@ -143,7 +143,7 @@ struct ctl_table_header 
	struct ctl_table_set *set;

	struct ctl_dir *parent;

	struct ctl_node *node;

	struct list_head inodes; /* head for proc_inode->sysctl_inodes */

	struct hlist_head inodes; /* head for proc_inode->sysctl_inodes */

};



struct ctl_dir {

CRA Git | Maintained and supported by SUSTech CRA and CCSE