Fix race between proc_readdir and remove_proc_entry

Review

Why have you dropped the first patch? Resending slightly fixed version of it.

[PATCH -mm] Fix race between proc_readdir and remove_proc_entry

From: "Darrick J. Wong" <[email protected]>

Fix the following race:

proc_readdir remove_proc_entry
============ =================

spin_lock(&proc_subdir_lock);
[choose PDE to start filldir from]

spin_unlock(&proc_subdir_lock);
					spin_lock(&proc_subdir_lock);
					[find PDE]
					[free PDE, refcount is 0]
					spin_unlock(&proc_subdir_lock);
		    /* boom */

if (filldir(dirent, de->name, ...

[de_put on error path --adobriyan]

---

 fs/proc/generic.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

@@ -478,14 +478,21 @@ int proc_readdir(struct file * filp,
 			}
 
 			do {
+				struct proc_dir_entry *next;
+
 				/* filldir passes info to user space */
+				de_get(de);
 				spin_unlock(&proc_subdir_lock);
 				if (filldir(dirent, de->name, de->namelen, filp->f_pos,
-					    de->low_ino, de->mode >> 12) < 0)
+					    de->low_ino, de->mode >> 12) < 0) {
+					de_put(de);
 					goto out;
+				}
 				spin_lock(&proc_subdir_lock);
 				filp->f_pos++;
-				de = de->next;
+				next = de->next;
+				de_put(de);
+				de = next;
 			} while (de);
 			spin_unlock(&proc_subdir_lock);
 	}