p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

netns: revert "netns: avoid disabling irq for netns id" 

This reverts commit bc51dddf98 ("netns: avoid disabling irq for
netns id") as it was found to cause problems with systems running
SELinux/audit, see the mailing list thread below:

 * http://marc.info/?t=147694653900002&r=1&w=2

Eventually we should be able to reintroduce this code once we have
rewritten the audit multicast code to queue messages much the same
way we do for unicast messages.  A tracking issue for this can be
found below:

 * https://github.com/linux-audit/audit-kernel/issues/23

Reported-by: Stephen Smalley <sds@tycho.nsa.gov>
Reported-by: Elad Raz <e@eladraz.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Paul Moore 2016-10-21 21:49:14 -04:00 committed by David S. Miller
parent 8651be8f14
commit 2a73306b60
1 changed files with 20 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
net/core/net_namespace.c
View File

@ -215,13 +215,14 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id);
*/ */
int peernet2id_alloc(struct net *net, struct net *peer) int peernet2id_alloc(struct net *net, struct net *peer)
{ {
unsigned long flags;
bool alloc; bool alloc;
int id; int id;
spin_lock_bh(&net->nsid_lock); spin_lock_irqsave(&net->nsid_lock, flags);
alloc = atomic_read(&peer->count) == 0 ? false : true; alloc = atomic_read(&peer->count) == 0 ? false : true;
id = __peernet2id_alloc(net, peer, &alloc); id = __peernet2id_alloc(net, peer, &alloc);
spin_unlock_bh(&net->nsid_lock); spin_unlock_irqrestore(&net->nsid_lock, flags);
if (alloc && id >= 0) if (alloc && id >= 0)
rtnl_net_notifyid(net, RTM_NEWNSID, id); rtnl_net_notifyid(net, RTM_NEWNSID, id);
return id; return id;
@ -230,11 +231,12 @@ int peernet2id_alloc(struct net *net, struct net *peer)
/* This function returns, if assigned, the id of a peer netns. */ /* This function returns, if assigned, the id of a peer netns. */
int peernet2id(struct net *net, struct net *peer) int peernet2id(struct net *net, struct net *peer)
{ {
unsigned long flags;
int id; int id;
spin_lock_bh(&net->nsid_lock); spin_lock_irqsave(&net->nsid_lock, flags);
id = __peernet2id(net, peer); id = __peernet2id(net, peer);
spin_unlock_bh(&net->nsid_lock); spin_unlock_irqrestore(&net->nsid_lock, flags);
return id; return id;
} }
EXPORT_SYMBOL(peernet2id); EXPORT_SYMBOL(peernet2id);
@ -249,17 +251,18 @@ bool peernet_has_id(struct net *net, struct net *peer)
struct net *get_net_ns_by_id(struct net *net, int id) struct net *get_net_ns_by_id(struct net *net, int id)
{ {
unsigned long flags;
struct net *peer; struct net *peer;
if (id < 0) if (id < 0)
return NULL; return NULL;
rcu_read_lock(); rcu_read_lock();
spin_lock_bh(&net->nsid_lock); spin_lock_irqsave(&net->nsid_lock, flags);
peer = idr_find(&net->netns_ids, id); peer = idr_find(&net->netns_ids, id);
if (peer) if (peer)
get_net(peer); get_net(peer);
spin_unlock_bh(&net->nsid_lock); spin_unlock_irqrestore(&net->nsid_lock, flags);
rcu_read_unlock(); rcu_read_unlock();
return peer; return peer;
@ -422,17 +425,17 @@ static void cleanup_net(struct work_struct *work)
for_each_net(tmp) { for_each_net(tmp) {
int id; int id;
spin_lock_bh(&tmp->nsid_lock); spin_lock_irq(&tmp->nsid_lock);
id = __peernet2id(tmp, net); id = __peernet2id(tmp, net);
if (id >= 0) if (id >= 0)
idr_remove(&tmp->netns_ids, id); idr_remove(&tmp->netns_ids, id);
spin_unlock_bh(&tmp->nsid_lock); spin_unlock_irq(&tmp->nsid_lock);
if (id >= 0) if (id >= 0)
rtnl_net_notifyid(tmp, RTM_DELNSID, id); rtnl_net_notifyid(tmp, RTM_DELNSID, id);
} }
spin_lock_bh(&net->nsid_lock); spin_lock_irq(&net->nsid_lock);
idr_destroy(&net->netns_ids); idr_destroy(&net->netns_ids);
spin_unlock_bh(&net->nsid_lock); spin_unlock_irq(&net->nsid_lock);
} }
rtnl_unlock(); rtnl_unlock();
@ -561,6 +564,7 @@ static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh)
{ {
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
struct nlattr *tb[NETNSA_MAX + 1]; struct nlattr *tb[NETNSA_MAX + 1];
unsigned long flags;
struct net *peer; struct net *peer;
int nsid, err; int nsid, err;
@ -581,15 +585,15 @@ static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh)
if (IS_ERR(peer)) if (IS_ERR(peer))
return PTR_ERR(peer); return PTR_ERR(peer);
spin_lock_bh(&net->nsid_lock); spin_lock_irqsave(&net->nsid_lock, flags);
if (__peernet2id(net, peer) >= 0) { if (__peernet2id(net, peer) >= 0) {
spin_unlock_bh(&net->nsid_lock); spin_unlock_irqrestore(&net->nsid_lock, flags);
err = -EEXIST; err = -EEXIST;
goto out; goto out;
} }
err = alloc_netid(net, peer, nsid); err = alloc_netid(net, peer, nsid);
spin_unlock_bh(&net->nsid_lock); spin_unlock_irqrestore(&net->nsid_lock, flags);
if (err >= 0) { if (err >= 0) {
rtnl_net_notifyid(net, RTM_NEWNSID, err); rtnl_net_notifyid(net, RTM_NEWNSID, err);
err = 0; err = 0;
@ -711,10 +715,11 @@ static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
.idx = 0, .idx = 0,
.s_idx = cb->args[0], .s_idx = cb->args[0],
}; };
unsigned long flags;
spin_lock_bh(&net->nsid_lock); spin_lock_irqsave(&net->nsid_lock, flags);
idr_for_each(&net->netns_ids, rtnl_net_dumpid_one, &net_cb); idr_for_each(&net->netns_ids, rtnl_net_dumpid_one, &net_cb);
spin_unlock_bh(&net->nsid_lock); spin_unlock_irqrestore(&net->nsid_lock, flags);
cb->args[0] = net_cb.idx; cb->args[0] = net_cb.idx;
return skb->len; return skb->len;