Commit 793925334f32e9026c22baee5c3c340f47d4ef7e
1 parent
2c53b436a3
Exists in
master
and in
7 other branches
proc: Fix Oops on stat of /proc/<zombie pid>/ns/net
Don't call iput with the inode half setup to be a namespace filedescriptor. Instead rearrange the code so that we don't initialize ei->ns_ops until after I ns_ops->get succeeds, preventing us from invoking ns_ops->put when ns_ops->get failed. Reported-by: Ingo Saitz <Ingo.Saitz@stud.uni-hannover.de> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Showing 1 changed file with 6 additions and 3 deletions Side-by-side Diff
fs/proc/namespaces.c
... | ... | @@ -38,18 +38,21 @@ |
38 | 38 | struct inode *inode; |
39 | 39 | struct proc_inode *ei; |
40 | 40 | struct dentry *error = ERR_PTR(-ENOENT); |
41 | + void *ns; | |
41 | 42 | |
42 | 43 | inode = proc_pid_make_inode(dir->i_sb, task); |
43 | 44 | if (!inode) |
44 | 45 | goto out; |
45 | 46 | |
47 | + ns = ns_ops->get(task); | |
48 | + if (!ns) | |
49 | + goto out_iput; | |
50 | + | |
46 | 51 | ei = PROC_I(inode); |
47 | 52 | inode->i_mode = S_IFREG|S_IRUSR; |
48 | 53 | inode->i_fop = &ns_file_operations; |
49 | 54 | ei->ns_ops = ns_ops; |
50 | - ei->ns = ns_ops->get(task); | |
51 | - if (!ei->ns) | |
52 | - goto out_iput; | |
55 | + ei->ns = ns; | |
53 | 56 | |
54 | 57 | dentry->d_op = &pid_dentry_operations; |
55 | 58 | d_add(dentry, inode); |