![Eric W. Biederman](/assets/img/avatar_default.png)
The usage of pid_ns->child_reaper->nsproxy->net_ns in nfs_server_list_open and nfs_client_list_open is not safe. /proc for a pid namespace can remain mounted after the all of the process in that pid namespace have exited. There are also times before the initial process in a pid namespace has started or after the initial process in a pid namespace has exited where pid_ns->child_reaper can be NULL or stale. Making the idiom pid_ns->child_reaper->nsproxy a double whammy of problems. Luckily all that needs to happen is to move /proc/fs/nfsfs/servers and /proc/fs/nfsfs/volumes under /proc/net to /proc/net/nfsfs/servers and /proc/net/nfsfs/volumes and add a symlink from the original location, and to use seq_open_net as it has been designed. Cc: stable@vger.kernel.org Cc: Trond Myklebust <trond.myklebust@primarydata.com> Cc: Stanislav Kinsbursky <skinsbursky@parallels.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
40 lines
878 B
C
40 lines
878 B
C
/*
|
|
* NFS-private data for each "struct net". Accessed with net_generic().
|
|
*/
|
|
|
|
#ifndef __NFS_NETNS_H__
|
|
#define __NFS_NETNS_H__
|
|
|
|
#include <linux/nfs4.h>
|
|
#include <net/net_namespace.h>
|
|
#include <net/netns/generic.h>
|
|
|
|
struct bl_dev_msg {
|
|
int32_t status;
|
|
uint32_t major, minor;
|
|
};
|
|
|
|
struct nfs_net {
|
|
struct cache_detail *nfs_dns_resolve;
|
|
struct rpc_pipe *bl_device_pipe;
|
|
struct bl_dev_msg bl_mount_reply;
|
|
wait_queue_head_t bl_wq;
|
|
struct list_head nfs_client_list;
|
|
struct list_head nfs_volume_list;
|
|
#if IS_ENABLED(CONFIG_NFS_V4)
|
|
struct idr cb_ident_idr; /* Protected by nfs_client_lock */
|
|
unsigned short nfs_callback_tcpport;
|
|
unsigned short nfs_callback_tcpport6;
|
|
int cb_users[NFS4_MAX_MINOR_VERSION + 1];
|
|
#endif
|
|
spinlock_t nfs_client_lock;
|
|
struct timespec boot_time;
|
|
#ifdef CONFIG_PROC_FS
|
|
struct proc_dir_entry *proc_nfsfs;
|
|
#endif
|
|
};
|
|
|
|
extern int nfs_net_id;
|
|
|
|
#endif
|