Alexey Dobriyan 5a622f2d0f proc: fix proc_dir_entry refcounting ... Creating PDEs with refcount 0 and "deleted" flag has problems (see below). Switch to usual scheme: * PDE is created with refcount 1 * every de_get does +1 * every de_put() and remove_proc_entry() do -1 * once refcount reaches 0, PDE is freed. This elegantly fixes at least two following races (both observed) without introducing new locks, without abusing old locks, without spreading lock_kernel(): 1) PDE leak remove_proc_entry de_put ----------------- ------ [refcnt = 1] if (atomic_read(&de->count) == 0) if (atomic_dec_and_test(&de->count)) if (de->deleted) /* also not taken! */ free_proc_entry(de); else de->deleted = 1; [refcount=0, deleted=1] 2) use after free remove_proc_entry de_put ----------------- ------ [refcnt = 1] if (atomic_dec_and_test(&de->count)) if (atomic_read(&de->count) == 0) free_proc_entry(de); /* boom! */ if (de->deleted) free_proc_entry(de); BUG: unable to handle kernel paging request at virtual address 6b6b6b6b printing eip: c10acdda *pdpt = 00000000338f8001 *pde = 0000000000000000 Oops: 0000 [#1] PREEMPT SMP Modules linked in: af_packet ipv6 cpufreq_ondemand loop serio_raw psmouse k8temp hwmon sr_mod cdrom Pid: 23161, comm: cat Not tainted (2.6.24-rc2-8c0863403f109a43d7000b4646da4818220d501f #4) EIP: 0060:[<c10acdda>] EFLAGS: 00210097 CPU: 1 EIP is at strnlen+0x6/0x18 EAX: 6b6b6b6b EBX: 6b6b6b6b ECX: 6b6b6b6b EDX: fffffffe ESI: c128fa3b EDI: f380bf34 EBP: ffffffff ESP: f380be44 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process cat (pid: 23161, ti=f380b000 task=f38f2570 task.ti=f380b000) Stack: c10ac4f0 00000278 c12ce000 f43cd2a8 00000163 00000000 7da86067 00000400 c128fa20 00896b18 f38325a8 c128fe20 ffffffff 00000000 c11f291e 00000400 f75be300 c128fa20 f769c9a0 c10ac779 f380bf34 f7bfee70 c1018e6b f380bf34 Call Trace: [<c10ac4f0>] vsnprintf+0x2ad/0x49b [<c10ac779>] vscnprintf+0x14/0x1f [<c1018e6b>] vprintk+0xc5/0x2f9 [<c10379f1>] handle_fasteoi_irq+0x0/0xab [<c1004f44>] do_IRQ+0x9f/0xb7 [<c117db3b>] preempt_schedule_irq+0x3f/0x5b [<c100264e>] need_resched+0x1f/0x21 [<c10190ba>] printk+0x1b/0x1f [<c107c8ad>] de_put+0x3d/0x50 [<c107c8f8>] proc_delete_inode+0x38/0x41 [<c107c8c0>] proc_delete_inode+0x0/0x41 [<c1066298>] generic_delete_inode+0x5e/0xc6 [<c1065aa9>] iput+0x60/0x62 [<c1063c8e>] d_kill+0x2d/0x46 [<c1063fa9>] dput+0xdc/0xe4 [<c10571a1>] __fput+0xb0/0xcd [<c1054e49>] filp_close+0x48/0x4f [<c1055ee9>] sys_close+0x67/0xa5 [<c10026b6>] sysenter_past_esp+0x5f/0x85 ======================= Code: c9 74 0c f2 ae 74 05 bf 01 00 00 00 4f 89 fa 5f 89 d0 c3 85 c9 57 89 c7 89 d0 74 05 f2 ae 75 01 4f 89 f8 5f c3 89 c1 89 c8 eb 06 <80> 38 00 74 07 40 4a 83 fa ff 75 f4 29 c8 c3 90 90 90 57 83 c9 EIP: [<c10acdda>] strnlen+0x6/0x18 SS:ESP 0068:f380be44 Also, remove broken usage of ->deleted from reiserfs: if sget() succeeds, module is already pinned and remove_proc_entry() can't happen => nobody can mark PDE deleted. Dummy proc root in netns code is not marked with refcount 1. AFAICS, we never get it, it's just for proper /proc/net removal. I double checked CLONE_NETNS continues to work. Patch survives many hours of modprobe/rmmod/cat loops without new bugs which can be attributed to refcounting. Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2007-12-05 09:21:20 -08:00
..
acpi	Pull cpuidle into release branch	2007-11-20 01:18:37 -05:00
asm-alpha	Add CONFIG_DEBUG_SG sg validation	2007-10-22 21:20:03 +02:00
asm-arm	Merge branch 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm	2007-11-30 08:11:18 -08:00
asm-avr32	[AVR32] Add missing bit in PCCR sysreg	2007-11-15 13:47:20 +01:00
asm-blackfin	Blackfin SPI driver: move hard coded pin_req to board file	2007-12-05 09:21:20 -08:00
asm-cris	CRIS tlb.h should include linux/pagemap.h	2007-11-14 18:45:47 -08:00
asm-frv	frv: Remove bogus NO_IRQ = -1 define	2007-11-09 15:11:44 -08:00
asm-generic	sched: fix RLIMIT_CPU comment	2007-11-26 21:21:49 +01:00
asm-h8300	Add CONFIG_DEBUG_SG sg validation	2007-10-22 21:20:03 +02:00
asm-ia64	ACPI: Set max_cstate to 1 for early Opterons.	2007-11-26 20:42:19 +01:00
asm-m32r	m32r: Update sys_rt_sigsuspend	2007-11-28 01:24:04 +09:00
asm-m68k	Add CONFIG_DEBUG_SG sg validation	2007-10-22 21:20:03 +02:00
asm-m68knommu	m68knommu: fix pread/pwrite defines	2007-11-05 15:12:33 -08:00
asm-mips	[MIPS] Fix use of smp_processor_id() in preemptible code.	2007-12-01 00:39:37 +00:00
asm-parisc	parisc: fix sg_page() fallout	2007-10-23 09:49:31 +02:00
asm-powerpc	Revert "[POWERPC] Fix RTAS os-term usage on kernel panic"	2007-12-03 09:39:45 +11:00
asm-ppc	ppc: fix AT_VECTOR_SIZE on arch/ppc	2007-10-22 19:18:54 -07:00
asm-s390	[S390] Fix irq tracing and lockdep_sys_exit calls.	2007-11-20 11:13:45 +01:00
asm-sh	sh: Fix copy_{to,from}_user_page() with cache disabled.	2007-11-19 12:55:51 +09:00
asm-sh64	sh: remove PTRACE_O_TRACESYSGOOD from asm/ptrace.h	2007-11-07 11:13:54 +09:00
asm-sparc	[SPARC32]: __inline__ --> inline	2007-10-27 00:17:01 -07:00
asm-sparc64	[SPARC64]: Use "is_power_of_2" macro for simplicity.	2007-11-07 02:24:33 -08:00
asm-um	uml: update address space affected by pud_clear	2007-11-14 18:45:37 -08:00
asm-v850	Add CONFIG_DEBUG_SG sg validation	2007-10-22 21:20:03 +02:00
asm-x86	x86: disable hpet on shutdown	2007-12-03 17:17:10 +01:00
asm-xtensa	xtensa: dma-mapping.h is using linux/scatterlist.h functions, so include it	2007-10-24 13:28:40 +02:00
crypto
keys
linux	proc: fix proc_dir_entry refcounting	2007-12-05 09:21:20 -08:00
math-emu
media	[PATCH] Fix breakage after SG cleanups	2007-10-23 12:02:39 -07:00
mtd
net	SCTP: Fix build issues with SCTP AUTH.	2007-11-29 10:17:42 -05:00
pcmcia	[AVR32] pcmcia ioaddr_t should be 32 bits on AVR32	2007-11-15 13:47:19 +01:00
rdma	cleanup asm/scatterlist.h includes	2007-11-02 08:47:06 +01:00
rxrpc
scsi	SCSI: add asynchronous event notification API	2007-11-03 22:23:02 -04:00
sound	[ALSA] version 1.0.15	2007-11-20 20:16:43 +01:00
video	Make asm-x86/bootparam.h includable from userspace.	2007-10-23 15:49:47 +10:00
xen
Kbuild