possible bug in fs/proc/generic.c

possible bug in fs/proc/generic.c

[Amir Noam]

Hi all,

Please CC me on any reply, since I'm not subscribed to the list.

I've stumbled upon something that looks like a bug, but since I'm
fairly new
to kernel programming, it can easily be a misunderstanding on my part.

The problem is that proc_register() (in fs/proc/generic.c) can fail
(returning -EAGAIN) if there are no more free node numbers in the
/proc fs.
However, no one is actually checking the return value of
proc_remove(). The
result, as I see it, is that when trying to create a new /proc entry
while
the maximal number of entries already exist, the new entry is
successfully
allocated, but cannot be linked to the rest of the /proc entries (via
the
pointers 'parent', 'subdir', etc...), and therefore cannot be accessed
through the file system.

Furthermore, this new entry can never be de-allocated, since there is
no
match for its name in the /proc fs.

So, is this an actual bug, or am I missing something completely
obvious
here?

Thanks in advance,
Amir Noam

possible bug in fs/proc/generic.c

[Amir Noam]

I've just noticed how horribly formatted this post came out, so I'm
sending it again. Hopefully this time it will be readable. Sorry about
that.

Please CC me on any reply, since I'm not subscribed to the list.

I've stumbled upon something that looks like a bug, but since I'm
fairly new to kernel programming, it can easily be a misunderstanding
on my part.

The problem is that proc_register() (in fs/proc/generic.c) can fail
(returning -EAGAIN) if there are no more free node numbers in the
/proc fs. However, no one is actually checking the return value of
proc_remove(). The result, as I see it, is that when trying to create
a new /proc entry while the maximal number of entries already exist,
the new entry is successfully allocated, but cannot be linked to the
rest of the /proc entries (via the pointers 'parent', 'subdir',
etc...), and therefore cannot be accessed through the file system.

Furthermore, this new entry can never be de-allocated, since there is
no match for its name in the /proc fs.

So, is this an actual bug, or am I missing something completely
obvious here?

Thanks in advance,
Amir Noam