[NET]: Fix race when opening a proc file while a network namespace is exiting.

The problem:  proc_net files remember which network namespace the are
against but do not remember hold a reference count (as that would pin
the network namespace).   So we currently have a small window where
the reference count on a network namespace may be incremented when opening
a /proc file when it has already gone to zero.

To fix this introduce maybe_get_net and get_proc_net.

maybe_get_net increments the network namespace reference count only if it is
greater then zero, ensuring we don't increment a reference count after it
has gone to zero.

get_proc_net handles all of the magic to go from a proc inode to the network
namespace instance and call maybe_get_net on it.

PROC_NET the old accessor is removed so that we don't get confused and use
the wrong helper function.

Then I fix up the callers to use get_proc_net and handle the case case
where get_proc_net returns NULL.  In that case I return -ENXIO because
effectively the network namespace has already gone away so the files
we are trying to access don't exist anymore.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Acked-by: Paul E. McKenney <paulmck@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

4 files changed, 20 insertions, 4 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index d16dcab49c6..666c112efb5 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2464,7 +2464,11 @@ static int dev_seq_open(struct inode *inode, struct file *file)
 	res =  seq_open(file, &dev_seq_ops);
 	if (!res) {
 		seq = file->private_data;
-		seq->private = get_net(PROC_NET(inode));
+		seq->private = get_proc_net(inode);
+		if (!seq->private) {
+			seq_release(inode, file);
+			res = -ENXIO;
+		}
 	}
 	return res;
 }
diff --git a/net/core/dev_mcast.c b/net/core/dev_mcast.c
index 1c4f6198459..896b0ca5aed 100644
--- a/net/core/dev_mcast.c
+++ b/net/core/dev_mcast.c
@@ -246,7 +246,11 @@ static int dev_mc_seq_open(struct inode *inode, struct file *file)
 	res = seq_open(file, &dev_mc_seq_ops);
 	if (!res) {
 		seq = file->private_data;
-		seq->private = get_net(PROC_NET(inode));
+		seq->private = get_proc_net(inode);
+		if (!seq->private) {
+			seq_release(inode, file);
+			res = -ENXIO;
+		}
 	}
 	return res;
 }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 3029f865cd6..dc9f8c2ab1d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1859,7 +1859,11 @@ static int netlink_seq_open(struct inode *inode, struct file *file)
 
 	seq = file->private_data;
 	seq->private = iter;
-	iter->net = get_net(PROC_NET(inode));
+	iter->net = get_proc_net(inode);
+	if (!iter->net) {
+		seq_release_private(inode, file);
+		return -ENXIO;
+	}
 	return 0;
 }
 
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index e8b3409d6c8..85e5f9dd0d8 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -678,7 +678,11 @@ static int wireless_seq_open(struct inode *inode, struct file *file)
 	res = seq_open(file, &wireless_seq_ops);
 	if (!res) {
 		seq = file->private_data;
-		seq->private = get_net(PROC_NET(inode));
+		seq->private = get_proc_net(inode);
+		if (!seq->private) {
+			seq_release(inode, file);
+			res = -ENXIO;
+		}
 	}
 	return res;
 }