summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2007-09-13 09:18:57 +0200
committerDavid S. Miller <davem@sunset.davemloft.net>2007-10-10 16:49:22 -0700
commit077130c0cf7d5ba1992f5b51b96136d7b1c8aad5 (patch)
treec8fd2622e7d633cc504c7543b55e25bd6d99a2fa /net
parent4fabcd7118162e36eea5c53e8895ecc13762bef3 (diff)
downloadlinux-stable-077130c0cf7d5ba1992f5b51b96136d7b1c8aad5.tar.gz
linux-stable-077130c0cf7d5ba1992f5b51b96136d7b1c8aad5.tar.bz2
linux-stable-077130c0cf7d5ba1992f5b51b96136d7b1c8aad5.zip
[NET]: Fix race when opening a proc file while a network namespace is exiting.
The problem: proc_net files remember which network namespace the are against but do not remember hold a reference count (as that would pin the network namespace). So we currently have a small window where the reference count on a network namespace may be incremented when opening a /proc file when it has already gone to zero. To fix this introduce maybe_get_net and get_proc_net. maybe_get_net increments the network namespace reference count only if it is greater then zero, ensuring we don't increment a reference count after it has gone to zero. get_proc_net handles all of the magic to go from a proc inode to the network namespace instance and call maybe_get_net on it. PROC_NET the old accessor is removed so that we don't get confused and use the wrong helper function. Then I fix up the callers to use get_proc_net and handle the case case where get_proc_net returns NULL. In that case I return -ENXIO because effectively the network namespace has already gone away so the files we are trying to access don't exist anymore. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Acked-by: Paul E. McKenney <paulmck@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/core/dev.c6
-rw-r--r--net/core/dev_mcast.c6
-rw-r--r--net/netlink/af_netlink.c6
-rw-r--r--net/wireless/wext.c6
4 files changed, 20 insertions, 4 deletions
diff --git a/net/core/dev.c b/net/core/dev.c
index d16dcab49c60..666c112efb55 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2464,7 +2464,11 @@ static int dev_seq_open(struct inode *inode, struct file *file)
res = seq_open(file, &dev_seq_ops);
if (!res) {
seq = file->private_data;
- seq->private = get_net(PROC_NET(inode));
+ seq->private = get_proc_net(inode);
+ if (!seq->private) {
+ seq_release(inode, file);
+ res = -ENXIO;
+ }
}
return res;
}
diff --git a/net/core/dev_mcast.c b/net/core/dev_mcast.c
index 1c4f6198459b..896b0ca5aed7 100644
--- a/net/core/dev_mcast.c
+++ b/net/core/dev_mcast.c
@@ -246,7 +246,11 @@ static int dev_mc_seq_open(struct inode *inode, struct file *file)
res = seq_open(file, &dev_mc_seq_ops);
if (!res) {
seq = file->private_data;
- seq->private = get_net(PROC_NET(inode));
+ seq->private = get_proc_net(inode);
+ if (!seq->private) {
+ seq_release(inode, file);
+ res = -ENXIO;
+ }
}
return res;
}
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 3029f865cd61..dc9f8c2ab1d5 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1859,7 +1859,11 @@ static int netlink_seq_open(struct inode *inode, struct file *file)
seq = file->private_data;
seq->private = iter;
- iter->net = get_net(PROC_NET(inode));
+ iter->net = get_proc_net(inode);
+ if (!iter->net) {
+ seq_release_private(inode, file);
+ return -ENXIO;
+ }
return 0;
}
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index e8b3409d6c8b..85e5f9dd0d8e 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -678,7 +678,11 @@ static int wireless_seq_open(struct inode *inode, struct file *file)
res = seq_open(file, &wireless_seq_ops);
if (!res) {
seq = file->private_data;
- seq->private = get_net(PROC_NET(inode));
+ seq->private = get_proc_net(inode);
+ if (!seq->private) {
+ seq_release(inode, file);
+ res = -ENXIO;
+ }
}
return res;
}