On Fri, Jan 04, 2019 at 09:21:23AM +0100, Mateusz Stępień wrote: > After changing network namespace using setns, the content of /proc/net > still represents the original namespace. > It looks like procfs dentries are not invalidated in dcache properly > after the namespace switch. > It happens only, when you read content of /proc/net before changing > namespace > The problem is reproducible in 4.19.13 but not in 4.14.X. > Bisecting the stable kernel tree shows that the commit > https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da4d377f943fe4194ffb9fb9c26cc58fad4dd24 > introduced the problem. > Reverting mentioned commit resolves it. > > MCVE (slightly modified example from [man 2 setns]): open /proc/net/dev read close setns open /proc/net/dev read close This bug was discussed recently and Al even posted how to fix it properly. Try this horror patch meanwhile: --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -219,19 +219,30 @@ void proc_free_inum(unsigned int inum) ida_simple_remove(&proc_inum_ida, inum - PROC_DYNAMIC_FIRST); } +static bool net_root(const struct proc_dir_entry *pde) +{ + return pde->parent == &proc_root && pde->mode == 0; +} + static int proc_misc_d_revalidate(struct dentry *dentry, unsigned int flags) { + const struct proc_dir_entry *pde; + if (flags & LOOKUP_RCU) return -ECHILD; - if (atomic_read(&PDE(d_inode(dentry))->in_use) < 0) + pde = PDE(d_inode(dentry)); + + if (atomic_read(&pde->in_use) < 0 || net_root(pde)) return 0; /* revalidate */ return 1; } static int proc_misc_d_delete(const struct dentry *dentry) { - return atomic_read(&PDE(d_inode(dentry))->in_use) < 0; + const struct proc_dir_entry *pde = PDE(d_inode(dentry)); + + return atomic_read(&pde->in_use) < 0 || net_root(pde); } static const struct dentry_operations proc_misc_dentry_ops = {
