Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 793925334f32e9026c22baee5c3c340f47d4ef7e

Authored by Eric W. Biederman
1 parent 2c53b436a3
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

proc: Fix Oops on stat of /proc/<zombie pid>/ns/net 

Don't call iput with the inode half setup to be a namespace filedescriptor.
Instead rearrange the code so that we don't initialize ei->ns_ops until
after I ns_ops->get succeeds, preventing us from invoking ns_ops->put
when ns_ops->get failed.

Reported-by: Ingo Saitz <Ingo.Saitz@stud.uni-hannover.de>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

Showing 1 changed file with 6 additions and 3 deletions Inline Diff

fs/proc/namespaces.c
Diff comments   View file @ 7939253
1 #include <linux/proc_fs.h> 1 #include <linux/proc_fs.h>
2 #include <linux/nsproxy.h> 2 #include <linux/nsproxy.h>
3 #include <linux/sched.h> 3 #include <linux/sched.h>
4 #include <linux/ptrace.h> 4 #include <linux/ptrace.h>
5 #include <linux/fs_struct.h> 5 #include <linux/fs_struct.h>
6 #include <linux/mount.h> 6 #include <linux/mount.h>
7 #include <linux/path.h> 7 #include <linux/path.h>
8 #include <linux/namei.h> 8 #include <linux/namei.h>
9 #include <linux/file.h> 9 #include <linux/file.h>
10 #include <linux/utsname.h> 10 #include <linux/utsname.h>
11 #include <net/net_namespace.h> 11 #include <net/net_namespace.h>
12 #include <linux/mnt_namespace.h> 12 #include <linux/mnt_namespace.h>
13 #include <linux/ipc_namespace.h> 13 #include <linux/ipc_namespace.h>
14 #include <linux/pid_namespace.h> 14 #include <linux/pid_namespace.h>
15 #include "internal.h" 15 #include "internal.h"
16 16
17 17
18 static const struct proc_ns_operations *ns_entries[] = { 18 static const struct proc_ns_operations *ns_entries[] = {
19 #ifdef CONFIG_NET_NS 19 #ifdef CONFIG_NET_NS
20 &netns_operations, 20 &netns_operations,
21 #endif 21 #endif
22 #ifdef CONFIG_UTS_NS 22 #ifdef CONFIG_UTS_NS
23 &utsns_operations, 23 &utsns_operations,
24 #endif 24 #endif
25 #ifdef CONFIG_IPC_NS 25 #ifdef CONFIG_IPC_NS
26 &ipcns_operations, 26 &ipcns_operations,
27 #endif 27 #endif
28 }; 28 };
29 29
30 static const struct file_operations ns_file_operations = { 30 static const struct file_operations ns_file_operations = {
31 .llseek = no_llseek, 31 .llseek = no_llseek,
32 }; 32 };
33 33
34 static struct dentry *proc_ns_instantiate(struct inode *dir, 34 static struct dentry *proc_ns_instantiate(struct inode *dir,
35 struct dentry *dentry, struct task_struct *task, const void *ptr) 35 struct dentry *dentry, struct task_struct *task, const void *ptr)
36 { 36 {
37 const struct proc_ns_operations *ns_ops = ptr; 37 const struct proc_ns_operations *ns_ops = ptr;
38 struct inode *inode; 38 struct inode *inode;
39 struct proc_inode *ei; 39 struct proc_inode *ei;
40 struct dentry *error = ERR_PTR(-ENOENT); 40 struct dentry *error = ERR_PTR(-ENOENT);
41 void *ns;
41 42
42 inode = proc_pid_make_inode(dir->i_sb, task); 43 inode = proc_pid_make_inode(dir->i_sb, task);
43 if (!inode) 44 if (!inode)
44 goto out; 45 goto out;
45 46
47 ns = ns_ops->get(task);
48 if (!ns)
49 goto out_iput;
50
46 ei = PROC_I(inode); 51 ei = PROC_I(inode);
47 inode->i_mode = S_IFREG|S_IRUSR; 52 inode->i_mode = S_IFREG|S_IRUSR;
48 inode->i_fop = &ns_file_operations; 53 inode->i_fop = &ns_file_operations;
49 ei->ns_ops = ns_ops; 54 ei->ns_ops = ns_ops;
50 ei->ns = ns_ops->get(task); 55 ei->ns = ns;
51 if (!ei->ns)
52 goto out_iput;
53 56
54 dentry->d_op = &pid_dentry_operations; 57 dentry->d_op = &pid_dentry_operations;
55 d_add(dentry, inode); 58 d_add(dentry, inode);
56 /* Close the race of the process dying before we return the dentry */ 59 /* Close the race of the process dying before we return the dentry */
57 if (pid_revalidate(dentry, NULL)) 60 if (pid_revalidate(dentry, NULL))
58 error = NULL; 61 error = NULL;
59 out: 62 out:
60 return error; 63 return error;
61 out_iput: 64 out_iput:
62 iput(inode); 65 iput(inode);
63 goto out; 66 goto out;
64 } 67 }
65 68
66 static int proc_ns_fill_cache(struct file *filp, void *dirent, 69 static int proc_ns_fill_cache(struct file *filp, void *dirent,
67 filldir_t filldir, struct task_struct *task, 70 filldir_t filldir, struct task_struct *task,
68 const struct proc_ns_operations *ops) 71 const struct proc_ns_operations *ops)
69 { 72 {
70 return proc_fill_cache(filp, dirent, filldir, 73 return proc_fill_cache(filp, dirent, filldir,
71 ops->name, strlen(ops->name), 74 ops->name, strlen(ops->name),
72 proc_ns_instantiate, task, ops); 75 proc_ns_instantiate, task, ops);
73 } 76 }
74 77
75 static int proc_ns_dir_readdir(struct file *filp, void *dirent, 78 static int proc_ns_dir_readdir(struct file *filp, void *dirent,
76 filldir_t filldir) 79 filldir_t filldir)
77 { 80 {
78 int i; 81 int i;
79 struct dentry *dentry = filp->f_path.dentry; 82 struct dentry *dentry = filp->f_path.dentry;
80 struct inode *inode = dentry->d_inode; 83 struct inode *inode = dentry->d_inode;
81 struct task_struct *task = get_proc_task(inode); 84 struct task_struct *task = get_proc_task(inode);
82 const struct proc_ns_operations **entry, **last; 85 const struct proc_ns_operations **entry, **last;
83 ino_t ino; 86 ino_t ino;
84 int ret; 87 int ret;
85 88
86 ret = -ENOENT; 89 ret = -ENOENT;
87 if (!task) 90 if (!task)
88 goto out_no_task; 91 goto out_no_task;
89 92
90 ret = -EPERM; 93 ret = -EPERM;
91 if (!ptrace_may_access(task, PTRACE_MODE_READ)) 94 if (!ptrace_may_access(task, PTRACE_MODE_READ))
92 goto out; 95 goto out;
93 96
94 ret = 0; 97 ret = 0;
95 i = filp->f_pos; 98 i = filp->f_pos;
96 switch (i) { 99 switch (i) {
97 case 0: 100 case 0:
98 ino = inode->i_ino; 101 ino = inode->i_ino;
99 if (filldir(dirent, ".", 1, i, ino, DT_DIR) < 0) 102 if (filldir(dirent, ".", 1, i, ino, DT_DIR) < 0)
100 goto out; 103 goto out;
101 i++; 104 i++;
102 filp->f_pos++; 105 filp->f_pos++;
103 /* fall through */ 106 /* fall through */
104 case 1: 107 case 1:
105 ino = parent_ino(dentry); 108 ino = parent_ino(dentry);
106 if (filldir(dirent, "..", 2, i, ino, DT_DIR) < 0) 109 if (filldir(dirent, "..", 2, i, ino, DT_DIR) < 0)
107 goto out; 110 goto out;
108 i++; 111 i++;
109 filp->f_pos++; 112 filp->f_pos++;
110 /* fall through */ 113 /* fall through */
111 default: 114 default:
112 i -= 2; 115 i -= 2;
113 if (i >= ARRAY_SIZE(ns_entries)) { 116 if (i >= ARRAY_SIZE(ns_entries)) {
114 ret = 1; 117 ret = 1;
115 goto out; 118 goto out;
116 } 119 }
117 entry = ns_entries + i; 120 entry = ns_entries + i;
118 last = &ns_entries[ARRAY_SIZE(ns_entries) - 1]; 121 last = &ns_entries[ARRAY_SIZE(ns_entries) - 1];
119 while (entry <= last) { 122 while (entry <= last) {
120 if (proc_ns_fill_cache(filp, dirent, filldir, 123 if (proc_ns_fill_cache(filp, dirent, filldir,
121 task, *entry) < 0) 124 task, *entry) < 0)
122 goto out; 125 goto out;
123 filp->f_pos++; 126 filp->f_pos++;
124 entry++; 127 entry++;
125 } 128 }
126 } 129 }
127 130
128 ret = 1; 131 ret = 1;
129 out: 132 out:
130 put_task_struct(task); 133 put_task_struct(task);
131 out_no_task: 134 out_no_task:
132 return ret; 135 return ret;
133 } 136 }
134 137
135 const struct file_operations proc_ns_dir_operations = { 138 const struct file_operations proc_ns_dir_operations = {
136 .read = generic_read_dir, 139 .read = generic_read_dir,
137 .readdir = proc_ns_dir_readdir, 140 .readdir = proc_ns_dir_readdir,
138 }; 141 };
139 142
140 static struct dentry *proc_ns_dir_lookup(struct inode *dir, 143 static struct dentry *proc_ns_dir_lookup(struct inode *dir,
141 struct dentry *dentry, struct nameidata *nd) 144 struct dentry *dentry, struct nameidata *nd)
142 { 145 {
143 struct dentry *error; 146 struct dentry *error;
144 struct task_struct *task = get_proc_task(dir); 147 struct task_struct *task = get_proc_task(dir);
145 const struct proc_ns_operations **entry, **last; 148 const struct proc_ns_operations **entry, **last;
146 unsigned int len = dentry->d_name.len; 149 unsigned int len = dentry->d_name.len;
147 150
148 error = ERR_PTR(-ENOENT); 151 error = ERR_PTR(-ENOENT);
149 152
150 if (!task) 153 if (!task)
151 goto out_no_task; 154 goto out_no_task;
152 155
153 error = ERR_PTR(-EPERM); 156 error = ERR_PTR(-EPERM);
154 if (!ptrace_may_access(task, PTRACE_MODE_READ)) 157 if (!ptrace_may_access(task, PTRACE_MODE_READ))
155 goto out; 158 goto out;
156 159
157 last = &ns_entries[ARRAY_SIZE(ns_entries) - 1]; 160 last = &ns_entries[ARRAY_SIZE(ns_entries) - 1];
158 for (entry = ns_entries; entry <= last; entry++) { 161 for (entry = ns_entries; entry <= last; entry++) {
159 if (strlen((*entry)->name) != len) 162 if (strlen((*entry)->name) != len)
160 continue; 163 continue;
161 if (!memcmp(dentry->d_name.name, (*entry)->name, len)) 164 if (!memcmp(dentry->d_name.name, (*entry)->name, len))
162 break; 165 break;
163 } 166 }
164 error = ERR_PTR(-ENOENT); 167 error = ERR_PTR(-ENOENT);
165 if (entry > last) 168 if (entry > last)
166 goto out; 169 goto out;
167 170
168 error = proc_ns_instantiate(dir, dentry, task, *entry); 171 error = proc_ns_instantiate(dir, dentry, task, *entry);
169 out: 172 out:
170 put_task_struct(task); 173 put_task_struct(task);
171 out_no_task: 174 out_no_task:
172 return error; 175 return error;
173 } 176 }
174 177
175 const struct inode_operations proc_ns_dir_inode_operations = { 178 const struct inode_operations proc_ns_dir_inode_operations = {
176 .lookup = proc_ns_dir_lookup, 179 .lookup = proc_ns_dir_lookup,
177 .getattr = pid_getattr, 180 .getattr = pid_getattr,
178 .setattr = proc_setattr, 181 .setattr = proc_setattr,
179 }; 182 };
180 183
181 struct file *proc_ns_fget(int fd) 184 struct file *proc_ns_fget(int fd)
182 { 185 {
183 struct file *file; 186 struct file *file;
184 187
185 file = fget(fd); 188 file = fget(fd);
186 if (!file) 189 if (!file)
187 return ERR_PTR(-EBADF); 190 return ERR_PTR(-EBADF);
188 191
189 if (file->f_op != &ns_file_operations) 192 if (file->f_op != &ns_file_operations)
190 goto out_invalid; 193 goto out_invalid;
191 194
192 return file; 195 return file;
193 196
194 out_invalid: 197 out_invalid:
195 fput(file); 198 fput(file);
196 return ERR_PTR(-EINVAL); 199 return ERR_PTR(-EINVAL);
197 } 200 }