: Fix potential net leak and oops in ipv6 routing code.

PATCH Applied Pavel Emelyanov 3 participants 3 messages Mar 26, 2008

Subsystems (3)

Networking Network drivers IPv4/IPv6

lore

Share & tools

lore

Pavel Emelyanov

author

2008-03-26 15:55 UTC #0 lore raw

PATCH 1/1 : Fix potential net leak and oops in ipv6 routing code.

The commits f3db4851 ([NETNS][IPV6] ip6_fib - fib6_clean_all handle several network namespaces) and 69ddb805 ([NETNS][IPV6] route6 - Make proc entry /proc/net/rt6_stats per namespace) made some proc files per net.

Both of them introduced potential OOPS - get_proc_net can return NULL, but this check is lost - and a struct net leak - in case single_open() fails the previously got net is not put.

Kill all these bugs with one patch.

Signed-off-by Pavel Emelyanov <[email protected]>

---

net/ipv6/route.c +20 -2

index ac44283..cd82b6d 100644
@@ -2390,10 +2390,18 @@ static int ipv6_route_show(struct seq_file *m, void *v)
 
 static int ipv6_route_open(struct inode *inode, struct file *file)
 {
+	int err;
 	struct net *net = get_proc_net(inode);
 	if (!net)
 		return -ENXIO;
-	return single_open(file, ipv6_route_show, net);
+
+	err = single_open(file, ipv6_route_show, net);
+	if (err < 0) {
+		put_net(net);
+		return err;
+	}
+
+	return 0;
 }
 
 static int ipv6_route_release(struct inode *inode, struct file *file)

@@ -2429,8 +2437,18 @@ static int rt6_stats_seq_show(struct seq_file *seq, void *v)
 
 static int rt6_stats_seq_open(struct inode *inode, struct file *file)
 {
+	int err;
 	struct net *net = get_proc_net(inode);
-	return single_open(file, rt6_stats_seq_show, net);
+	if (!net)
+		return -ENXIO;
+
+	err = single_open(file, rt6_stats_seq_show, net);
+	if (err < 0) {
+		put_net(net);
+		return err;
+	}
+
+	return 0;
 }
 
 static int rt6_stats_seq_release(struct inode *inode, struct file *file)

Daniel Lezcano

Acked-by on v1 1/1

2008-03-26 16:00 UTC #1 lore raw

Quoted 46 lines · Pavel Emelyanov

The commits f3db4851 ([NETNS][IPV6] ip6_fib - fib6_clean_all handle several network namespaces) and 69ddb805 ([NETNS][IPV6] route6 - Make proc entry /proc/net/rt6_stats per namespace) made some proc files per net.
Both of them introduced potential OOPS - get_proc_net can return NULL, but this check is lost - and a struct net leak - in case single_open() fails the previously got net is not put.
Kill all these bugs with one patch.
Signed-off-by Pavel Emelyanov <[email protected]>
---
net/ipv6/route.c +13 -2
index ac44283..cd82b6d 100644
@@ -2390,10 +2390,18 @@ static int ipv6_route_show(struct seq_file *m, void *v)
 
 static int ipv6_route_open(struct inode *inode, struct file *file)
 {
+	int err;
 	struct net *net = get_proc_net(inode);
 	if (!net)
 		return -ENXIO;
-	return single_open(file, ipv6_route_show, net);
+
+	err = single_open(file, ipv6_route_show, net);
+	if (err < 0) {
+		put_net(net);
+		return err;
+	}
+
+	return 0;
 }
 
 static int ipv6_route_release(struct inode *inode, struct file *file)
@@ -2429,8 +2437,18 @@ static int rt6_stats_seq_show(struct seq_file *seq, void *v)
 
 static int rt6_stats_seq_open(struct inode *inode, struct file *file)
 {
+	int err;
 	struct net *net = get_proc_net(inode);
-	return single_open(file, rt6_stats_seq_show, net);
+	if (!net)
+		return -ENXIO;
+

net/ipv6/route.c static int rt6_stats_seq_show(struct seq_file *seq, void *v) · line 2454

Quoted 10 lines

net/ipv6/route.c +7 -0

+	err = single_open(file, rt6_stats_seq_show, net);
+	if (err < 0) {
+		put_net(net);
+		return err;
+	}
+
+	return 0;
 }
 
 static int rt6_stats_seq_release(struct inode *inode, struct file *file)

Good catch. Thanks.

Acked-by Daniel Lezcano <[email protected]>

David Miller

maintainer Applied

2008-03-26 23:50 UTC #2 lore raw

From: Daniel Lezcano <[email protected]>
Date: Wed, 26 Mar 2008 16:59:29 +0100

Quoted 12 lines

Quoted 11 lines · Pavel Emelyanov
The commits f3db4851 ([NETNS][IPV6] ip6_fib - fib6_clean_all handle several network namespaces) and 69ddb805 ([NETNS][IPV6] route6 - Make proc entry /proc/net/rt6_stats per namespace) made some proc files per net.
Both of them introduced potential OOPS - get_proc_net can return NULL, but this check is lost - and a struct net leak - in case single_open() fails the previously got net is not put.
Kill all these bugs with one patch.
Signed-off-by Pavel Emelyanov <[email protected]>

...

Quoted 3 lines

Good catch. Thanks.
Acked-by Daniel Lezcano <[email protected]>

Applied, thanks everyone!