proc: fix lookup in /proc/net subdirectories after setns(2)
authorAlexey Dobriyan <adobriyan@gmail.com>
Wed, 16 Dec 2020 04:42:39 +0000 (20:42 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 30 Dec 2020 10:53:56 +0000 (11:53 +0100)
commitb202ac9c7345a917ec429479dd64d46c7719343c
tree37ce687ab5603527e631c559266f7a1bce9c3ef3
parentbd3f4b6fd98ca7e77cca3c7299353ea787f3bf36
proc: fix lookup in /proc/net subdirectories after setns(2)

[ Upstream commit c6c75deda81344c3a95d1d1f606d5cee109e5d54 ]

Commit 1fde6f21d90f ("proc: fix /proc/net/* after setns(2)") only forced
revalidation of regular files under /proc/net/

However, /proc/net/ is unusual in the sense of /proc/net/foo handlers
take netns pointer from parent directory which is old netns.

Steps to reproduce:

(void)open("/proc/net/sctp/snmp", O_RDONLY);
unshare(CLONE_NEWNET);

int fd = open("/proc/net/sctp/snmp", O_RDONLY);
read(fd, &c, 1);

Read will read wrong data from original netns.

Patch forces lookup on every directory under /proc/net .

Link: https://lkml.kernel.org/r/20201205160916.GA109739@localhost.localdomain
Fixes: 1da4d377f943 ("proc: revalidate misc dentries")
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Reported-by: "Rantala, Tommi T. (Nokia - FI/Espoo)" <tommi.t.rantala@nokia.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/proc/generic.c
fs/proc/internal.h
fs/proc/proc_net.c
include/linux/proc_fs.h