OpenVZ Forum


Home » Mailing lists » Devel » [PATCH net-2.6.26][IPV6]: Fix potential net leak and oops in ipv6 routing code.
[PATCH net-2.6.26][IPV6]: Fix potential net leak and oops in ipv6 routing code. [message #28703] Wed, 26 March 2008 15:55 Go to next message
Pavel Emelianov is currently offline  Pavel Emelianov
Messages: 1149
Registered: September 2006
Senior Member
The commits f3db4851 ([NETNS][IPV6] ip6_fib - fib6_clean_all handle several 
network namespaces) and 69ddb805 ([NETNS][IPV6] route6 - Make proc entry 
/proc/net/rt6_stats per namespace) made some proc files per net.

Both of them introduced potential OOPS - get_proc_net can return NULL, but
this check is lost - and a struct net leak - in case single_open() fails the
previously got net is not put.

Kill all these bugs with one patch.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>

---

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ac44283..cd82b6d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2390,10 +2390,18 @@ static int ipv6_route_show(struct seq_file *m, void *v)
 
 static int ipv6_route_open(struct inode *inode, struct file *file)
 {
+	int err;
 	struct net *net = get_proc_net(inode);
 	if (!net)
 		return -ENXIO;
-	return single_open(file, ipv6_route_show, net);
+
+	err = single_open(file, ipv6_route_show, net);
+	if (err < 0) {
+		put_net(net);
+		return err;
+	}
+
+	return 0;
 }
 
 static int ipv6_route_release(struct inode *inode, struct file *file)
@@ -2429,8 +2437,18 @@ static int rt6_stats_seq_show(struct seq_file *seq, void *v)
 
 static int rt6_stats_seq_open(struct inode *inode, struct file *file)
 {
+	int err;
 	struct net *net = get_proc_net(inode);
-	return single_open(file, rt6_stats_seq_show, net);
+	if (!net)
+		return -ENXIO;
+
+	err = single_open(file, rt6_stats_seq_show, net);
+	if (err < 0) {
+		put_net(net);
+		return err;
+	}
+
+	return 0;
 }
 
 static int rt6_stats_seq_release(struct inode *inode, struct file *file)
Re: [PATCH net-2.6.26][IPV6]: Fix potential net leak and oops in ipv6 routing code. [message #28705 is a reply to message #28703] Wed, 26 March 2008 15:59 Go to previous messageGo to next message
Daniel Lezcano is currently offline  Daniel Lezcano
Messages: 417
Registered: June 2006
Senior Member
Pavel Emelyanov wrote:
> The commits f3db4851 ([NETNS][IPV6] ip6_fib - fib6_clean_all handle several 
> network namespaces) and 69ddb805 ([NETNS][IPV6] route6 - Make proc entry 
> /proc/net/rt6_stats per namespace) made some proc files per net.
> 
> Both of them introduced potential OOPS - get_proc_net can return NULL, but
> this check is lost - and a struct net leak - in case single_open() fails the
> previously got net is not put.
> 
> Kill all these bugs with one patch.
> 
> Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
> 
> ---
> 
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index ac44283..cd82b6d 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -2390,10 +2390,18 @@ static int ipv6_route_show(struct seq_file *m, void *v)
> 
>  static int ipv6_route_open(struct inode *inode, struct file *file)
>  {
> +	int err;
>  	struct net *net = get_proc_net(inode);
>  	if (!net)
>  		return -ENXIO;
> -	return single_open(file, ipv6_route_show, net);
> +
> +	err = single_open(file, ipv6_route_show, net);
> +	if (err < 0) {
> +		put_net(net);
> +		return err;
> +	}
> +
> +	return 0;
>  }
> 
>  static int ipv6_route_release(struct inode *inode, struct file *file)
> @@ -2429,8 +2437,18 @@ static int rt6_stats_seq_show(struct seq_file *seq, void *v)
> 
>  static int rt6_stats_seq_open(struct inode *inode, struct file *file)
>  {
> +	int err;
>  	struct net *net = get_proc_net(inode);
> -	return single_open(file, rt6_stats_seq_show, net);
> +	if (!net)
> +		return -ENXIO;
> +
> +	err = single_open(file, rt6_stats_seq_show, net);
> +	if (err < 0) {
> +		put_net(net);
> +		return err;
> +	}
> +
> +	return 0;
>  }
> 
>  static int rt6_stats_seq_release(struct inode *inode, struct file *file)

Good catch. Thanks.

Acked-by: Daniel Lezcano <dlezcano@fr.ibm.com>
Re: [PATCH net-2.6.26][IPV6]: Fix potential net leak and oops in ipv6 routing code. [message #28721 is a reply to message #28705] Wed, 26 March 2008 23:50 Go to previous message
davem is currently offline  davem
Messages: 463
Registered: February 2006
Senior Member
From: Daniel Lezcano <dlezcano@fr.ibm.com>
Date: Wed, 26 Mar 2008 16:59:29 +0100

> Pavel Emelyanov wrote:
> > The commits f3db4851 ([NETNS][IPV6] ip6_fib - fib6_clean_all handle several 
> > network namespaces) and 69ddb805 ([NETNS][IPV6] route6 - Make proc entry 
> > /proc/net/rt6_stats per namespace) made some proc files per net.
> > 
> > Both of them introduced potential OOPS - get_proc_net can return NULL, but
> > this check is lost - and a struct net leak - in case single_open() fails the
> > previously got net is not put.
> > 
> > Kill all these bugs with one patch.
> > 
> > Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
 ...
> Good catch. Thanks.
> 
> Acked-by: Daniel Lezcano <dlezcano@fr.ibm.com>

Applied, thanks everyone!
Previous Topic: [RFC][-mm] [2/2] Simple stats for memory resource controller
Next Topic: [patch 0/3][NETNS][IPV6] make anycast and ip6_flowlabels per namespace
Goto Forum:
  


Current Time: Sun May 26 11:26:12 GMT 2024

Total time taken to generate the page: 0.01914 seconds