On Mon 02-11-26 15:21:37, Christian Brauner wrote:
proc_net_ns_exit() runs after all the other pernet exits and frees
net->proc_net right after removing "stat" from it. An entry that some
pernet exit forgot to remove is left with a freed ->parent, and so
PDE_NET() hands seq_open_net() and single_open_net() a freed struct net
when the entry is opened through a file descriptor that someone kept.
There is no such entry in the tree that we know of, but nothing would
tell us about one either. So warn about it like remove_proc_entry()
does for a directory that isn't empty.
Reported-by: Chris Mason <mason@kernel.org>
Fixes: e9720acd728a ("[NET]: Make /proc/net a symlink on /proc/self/net (v3)")
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
OK, why not. Feel free to add:
Reviewed-by: Jan Kara <jack@suse.cz>
Honza
quoted hunk ↗ jump to hunk
---
fs/proc/proc_net.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index dbcf87a257e1..df5484813d5d 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -410,7 +410,13 @@ static __net_init int proc_net_ns_init(struct net *net)
static __net_exit void proc_net_ns_exit(struct net *net)
{
+ struct proc_dir_entry *left;
+
remove_proc_entry("stat", net->proc_net);
+ /* Whatever is left still points at net->proc_net and so at net. */
+ left = rb_entry_safe(rb_first(&net->proc_net->subdir),
+ struct proc_dir_entry, subdir_node);
+ WARN(left, "/proc/net: leaking at least '%s'\n", left->name);
pde_free(net->proc_net);
}
--
2.53.0
--
Jan Kara [off-list ref]
SUSE Labs, CR