On Mon 02-11-26 15:21:37, Christian Brauner wrote: > proc_net_ns_exit() runs after all the other pernet exits and frees > net->proc_net right after removing "stat" from it. An entry that some > pernet exit forgot to remove is left with a freed ->parent, and so > PDE_NET() hands seq_open_net() and single_open_net() a freed struct net > when the entry is opened through a file descriptor that someone kept. > > There is no such entry in the tree that we know of, but nothing would > tell us about one either. So warn about it like remove_proc_entry() > does for a directory that isn't empty. > > Reported-by: Chris Mason <[email protected]> > Fixes: e9720acd728a ("[NET]: Make /proc/net a symlink on /proc/self/net (v3)") > Signed-off-by: Christian Brauner (Amutable) <[email protected]>
OK, why not. Feel free to add: Reviewed-by: Jan Kara <[email protected]> Honza > --- > fs/proc/proc_net.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c > index dbcf87a257e1..df5484813d5d 100644 > --- a/fs/proc/proc_net.c > +++ b/fs/proc/proc_net.c > @@ -410,7 +410,13 @@ static __net_init int proc_net_ns_init(struct net *net) > > static __net_exit void proc_net_ns_exit(struct net *net) > { > + struct proc_dir_entry *left; > + > remove_proc_entry("stat", net->proc_net); > + /* Whatever is left still points at net->proc_net and so at net. */ > + left = rb_entry_safe(rb_first(&net->proc_net->subdir), > + struct proc_dir_entry, subdir_node); > + WARN(left, "/proc/net: leaking at least '%s'\n", left->name); > pde_free(net->proc_net); > } > > > -- > 2.53.0 > -- Jan Kara <[email protected]> SUSE Labs, CR
