rose: Add length checks to CALL_REQUEST parsing, CVE-2011-1493
[linux-flexiantxendom0-natty.git] / net / rose / af_rose.c
index f92d531..9eb767f 100644 (file)
@@ -18,6 +18,7 @@
 #include <linux/types.h>
 #include <linux/socket.h>
 #include <linux/in.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
@@ -26,6 +27,7 @@
 #include <linux/sockios.h>
 #include <linux/net.h>
 #include <linux/stat.h>
+#include <net/net_namespace.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -62,7 +64,7 @@ int sysctl_rose_window_size             = ROSE_DEFAULT_WINDOW_SIZE;
 static HLIST_HEAD(rose_list);
 static DEFINE_SPINLOCK(rose_list_lock);
 
-static struct proto_ops rose_proto_ops;
+static const struct proto_ops rose_proto_ops;
 
 ax25_address rose_callsign;
 
@@ -73,27 +75,39 @@ ax25_address rose_callsign;
  * separate class since they always nest.
  */
 static struct lock_class_key rose_netdev_xmit_lock_key;
+static struct lock_class_key rose_netdev_addr_lock_key;
+
+static void rose_set_lockdep_one(struct net_device *dev,
+                                struct netdev_queue *txq,
+                                void *_unused)
+{
+       lockdep_set_class(&txq->_xmit_lock, &rose_netdev_xmit_lock_key);
+}
+
+static void rose_set_lockdep_key(struct net_device *dev)
+{
+       lockdep_set_class(&dev->addr_list_lock, &rose_netdev_addr_lock_key);
+       netdev_for_each_tx_queue(dev, rose_set_lockdep_one, NULL);
+}
 
 /*
  *     Convert a ROSE address into text.
  */
-const char *rose2asc(const rose_address *addr)
+char *rose2asc(char *buf, const rose_address *addr)
 {
-       static char buffer[11];
-
        if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 &&
            addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 &&
            addr->rose_addr[4] == 0x00) {
-               strcpy(buffer, "*");
+               strcpy(buf, "*");
        } else {
-               sprintf(buffer, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
+               sprintf(buf, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
                                                addr->rose_addr[1] & 0xFF,
                                                addr->rose_addr[2] & 0xFF,
                                                addr->rose_addr[3] & 0xFF,
                                                addr->rose_addr[4] & 0xFF);
        }
 
-       return buffer;
+       return buf;
 }
 
 /*
@@ -115,7 +129,7 @@ int rosecmp(rose_address *addr1, rose_address *addr2)
  */
 int rosecmpm(rose_address *addr1, rose_address *addr2, unsigned short mask)
 {
-       int i, j;
+       unsigned int i, j;
 
        if (mask > 10)
                return 1;
@@ -196,6 +210,9 @@ static int rose_device_event(struct notifier_block *this, unsigned long event,
 {
        struct net_device *dev = (struct net_device *)ptr;
 
+       if (!net_eq(dev_net(dev), &init_net))
+               return NOTIFY_DONE;
+
        if (event != NETDEV_DOWN)
                return NOTIFY_DONE;
 
@@ -338,13 +355,11 @@ void rose_destroy_socket(struct sock *sk)
                kfree_skb(skb);
        }
 
-       if (atomic_read(&sk->sk_wmem_alloc) ||
-           atomic_read(&sk->sk_rmem_alloc)) {
+       if (sk_has_allocations(sk)) {
                /* Defer: outstanding buffers */
-               init_timer(&sk->sk_timer);
+               setup_timer(&sk->sk_timer, rose_destroy_timer,
+                               (unsigned long)sk);
                sk->sk_timer.expires  = jiffies + 10 * HZ;
-               sk->sk_timer.function = rose_destroy_timer;
-               sk->sk_timer.data     = (unsigned long)sk;
                add_timer(&sk->sk_timer);
        } else
                sock_put(sk);
@@ -356,7 +371,7 @@ void rose_destroy_socket(struct sock *sk)
  */
 
 static int rose_setsockopt(struct socket *sock, int level, int optname,
-       char __user *optval, int optlen)
+       char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct rose_sock *rose = rose_sk(sk);
@@ -498,15 +513,20 @@ static struct proto rose_proto = {
        .obj_size = sizeof(struct rose_sock),
 };
 
-static int rose_create(struct socket *sock, int protocol)
+static int rose_create(struct net *net, struct socket *sock, int protocol,
+                      int kern)
 {
        struct sock *sk;
        struct rose_sock *rose;
 
+       if (!net_eq(net, &init_net))
+               return -EAFNOSUPPORT;
+
        if (sock->type != SOCK_SEQPACKET || protocol != 0)
                return -ESOCKTNOSUPPORT;
 
-       if ((sk = sk_alloc(PF_ROSE, GFP_ATOMIC, &rose_proto, 1)) == NULL)
+       sk = sk_alloc(net, PF_ROSE, GFP_ATOMIC, &rose_proto);
+       if (sk == NULL)
                return -ENOMEM;
 
        rose = rose_sk(sk);
@@ -544,7 +564,8 @@ static struct sock *rose_make_new(struct sock *osk)
        if (osk->sk_type != SOCK_SEQPACKET)
                return NULL;
 
-       if ((sk = sk_alloc(PF_ROSE, GFP_ATOMIC, &rose_proto, 1)) == NULL)
+       sk = sk_alloc(sock_net(osk), PF_ROSE, GFP_ATOMIC, &rose_proto);
+       if (sk == NULL)
                return NULL;
 
        rose = rose_sk(sk);
@@ -558,13 +579,11 @@ static struct sock *rose_make_new(struct sock *osk)
 #endif
 
        sk->sk_type     = osk->sk_type;
-       sk->sk_socket   = osk->sk_socket;
        sk->sk_priority = osk->sk_priority;
        sk->sk_protocol = osk->sk_protocol;
        sk->sk_rcvbuf   = osk->sk_rcvbuf;
        sk->sk_sndbuf   = osk->sk_sndbuf;
        sk->sk_state    = TCP_ESTABLISHED;
-       sk->sk_sleep    = osk->sk_sleep;
        sock_copy_flags(sk, osk);
 
        init_timer(&rose->timer);
@@ -590,17 +609,24 @@ static int rose_release(struct socket *sock)
 
        if (sk == NULL) return 0;
 
+       sock_hold(sk);
+       sock_orphan(sk);
+       lock_sock(sk);
        rose = rose_sk(sk);
 
        switch (rose->state) {
        case ROSE_STATE_0:
+               release_sock(sk);
                rose_disconnect(sk, 0, -1, -1);
+               lock_sock(sk);
                rose_destroy_socket(sk);
                break;
 
        case ROSE_STATE_2:
                rose->neighbour->use--;
+               release_sock(sk);
                rose_disconnect(sk, 0, -1, -1);
+               lock_sock(sk);
                rose_destroy_socket(sk);
                break;
 
@@ -625,6 +651,8 @@ static int rose_release(struct socket *sock)
        }
 
        sock->sk = NULL;
+       release_sock(sk);
+       sock_put(sk);
 
        return 0;
 }
@@ -651,7 +679,7 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
                return -EINVAL;
 
-       if (addr->srose_ndigis > ROSE_MAX_DIGIS)
+       if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
                return -EINVAL;
 
        if ((dev = rose_dev_get(&addr->srose_addr)) == NULL) {
@@ -661,7 +689,7 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
        source = &addr->srose_call;
 
-       user = ax25_findbyuid(current->euid);
+       user = ax25_findbyuid(current_euid());
        if (user) {
                rose->source_call = user->call;
                ax25_uid_put(user);
@@ -711,7 +739,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
        if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
                return -EINVAL;
 
-       if (addr->srose_ndigis > ROSE_MAX_DIGIS)
+       if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
                return -EINVAL;
 
        /* Source + Destination digis should not exceed ROSE_MAX_DIGIS */
@@ -742,9 +770,11 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
        sock->state = SS_UNCONNECTED;
 
        rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause,
-                                        &diagnostic);
-       if (!rose->neighbour)
-               return -ENETUNREACH;
+                                        &diagnostic, 0);
+       if (!rose->neighbour) {
+               err = -ENETUNREACH;
+               goto out_release;
+       }
 
        rose->lci = rose_new_lci(rose->neighbour);
        if (!rose->lci) {
@@ -760,7 +790,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
                        goto out_release;
                }
 
-               user = ax25_findbyuid(current->euid);
+               user = ax25_findbyuid(current_euid());
                if (!user) {
                        err = -EINVAL;
                        goto out_release;
@@ -812,31 +842,31 @@ rose_try_next_neigh:
         * closed.
         */
        if (sk->sk_state == TCP_SYN_SENT) {
-               struct task_struct *tsk = current;
-               DECLARE_WAITQUEUE(wait, tsk);
+               DEFINE_WAIT(wait);
 
-               add_wait_queue(sk->sk_sleep, &wait);
                for (;;) {
-                       set_current_state(TASK_INTERRUPTIBLE);
+                       prepare_to_wait(sk_sleep(sk), &wait,
+                                       TASK_INTERRUPTIBLE);
                        if (sk->sk_state != TCP_SYN_SENT)
                                break;
-                       release_sock(sk);
-                       if (!signal_pending(tsk)) {
+                       if (!signal_pending(current)) {
+                               release_sock(sk);
                                schedule();
                                lock_sock(sk);
                                continue;
                        }
-                       current->state = TASK_RUNNING;
-                       remove_wait_queue(sk->sk_sleep, &wait);
-                       return -ERESTARTSYS;
+                       err = -ERESTARTSYS;
+                       break;
                }
-               current->state = TASK_RUNNING;
-               remove_wait_queue(sk->sk_sleep, &wait);
+               finish_wait(sk_sleep(sk), &wait);
+
+               if (err)
+                       goto out_release;
        }
 
        if (sk->sk_state != TCP_ESTABLISHED) {
        /* Try next neighbour */
-               rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause, &diagnostic);
+               rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause, &diagnostic, 0);
                if (rose->neighbour)
                        goto rose_try_next_neigh;
 
@@ -856,10 +886,9 @@ out_release:
 
 static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
 {
-       struct task_struct *tsk = current;
-       DECLARE_WAITQUEUE(wait, tsk);
        struct sk_buff *skb;
        struct sock *newsk;
+       DEFINE_WAIT(wait);
        struct sock *sk;
        int err = 0;
 
@@ -869,54 +898,51 @@ static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
        lock_sock(sk);
        if (sk->sk_type != SOCK_SEQPACKET) {
                err = -EOPNOTSUPP;
-               goto out;
+               goto out_release;
        }
 
        if (sk->sk_state != TCP_LISTEN) {
                err = -EINVAL;
-               goto out;
+               goto out_release;
        }
 
        /*
         *      The write queue this time is holding sockets ready to use
         *      hooked into the SABM we saved
         */
-       add_wait_queue(sk->sk_sleep, &wait);
        for (;;) {
+               prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+
                skb = skb_dequeue(&sk->sk_receive_queue);
                if (skb)
                        break;
 
-               current->state = TASK_INTERRUPTIBLE;
-               release_sock(sk);
                if (flags & O_NONBLOCK) {
-                       current->state = TASK_RUNNING;
-                       remove_wait_queue(sk->sk_sleep, &wait);
-                       return -EWOULDBLOCK;
+                       err = -EWOULDBLOCK;
+                       break;
                }
-               if (!signal_pending(tsk)) {
+               if (!signal_pending(current)) {
+                       release_sock(sk);
                        schedule();
                        lock_sock(sk);
                        continue;
                }
-               current->state = TASK_RUNNING;
-               remove_wait_queue(sk->sk_sleep, &wait);
-               return -ERESTARTSYS;
+               err = -ERESTARTSYS;
+               break;
        }
-       current->state = TASK_RUNNING;
-       remove_wait_queue(sk->sk_sleep, &wait);
+       finish_wait(sk_sleep(sk), &wait);
+       if (err)
+               goto out_release;
 
        newsk = skb->sk;
-       newsk->sk_socket = newsock;
-       newsk->sk_sleep = &newsock->wait;
+       sock_graft(newsk, newsock);
 
        /* Now attach up the new socket */
        skb->sk = NULL;
        kfree_skb(skb);
        sk->sk_ack_backlog--;
-       newsock->sk = newsk;
 
-out:
+out_release:
        release_sock(sk);
 
        return err;
@@ -930,6 +956,7 @@ static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
        struct rose_sock *rose = rose_sk(sk);
        int n;
 
+       memset(srose, 0, sizeof(*srose));
        if (peer != 0) {
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -ENOTCONN;
@@ -958,7 +985,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
        struct sock *make;
        struct rose_sock *make_rose;
        struct rose_facilities_struct facilities;
-       int n, len;
+       int n;
 
        skb->sk = NULL;         /* Initially we don't know who it's for */
 
@@ -967,9 +994,9 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
         */
        memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
 
-       len  = (((skb->data[3] >> 4) & 0x0F) + 1) / 2;
-       len += (((skb->data[3] >> 0) & 0x0F) + 1) / 2;
-       if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
+       if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
+                                  skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
+                                  &facilities)) {
                rose_transmit_clear_request(neigh, lci, ROSE_INVALID_FACILITY, 76);
                return 0;
        }
@@ -1093,6 +1120,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
 
        /* Build a packet */
        SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n");
+       /* Sanity check the packet size */
+       if (len > 65535)
+               return -EMSGSIZE;
+
        size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
 
        if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)
@@ -1105,9 +1136,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
         */
        SOCK_DEBUG(sk, "ROSE: Appending user data\n");
 
-       asmptr = skb->h.raw = skb_put(skb, len);
+       skb_reset_transport_header(skb);
+       skb_put(skb, len);
 
-       err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+       err = memcpy_fromiovec(skb_transport_header(skb), msg->msg_iov, len);
        if (err) {
                kfree_skb(skb);
                return err;
@@ -1155,7 +1187,7 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
                int lg;
 
                /* Save a copy of the Header */
-               memcpy(header, skb->data, ROSE_MIN_LEN);
+               skb_copy_from_linear_data(skb, header, ROSE_MIN_LEN);
                skb_pull(skb, ROSE_MIN_LEN);
 
                frontlen = skb_headroom(skb);
@@ -1175,12 +1207,12 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
                        lg = (ROSE_PACLEN > skb->len) ? skb->len : ROSE_PACLEN;
 
                        /* Copy the user data */
-                       memcpy(skb_put(skbn, lg), skb->data, lg);
+                       skb_copy_from_linear_data(skb, skb_put(skbn, lg), lg);
                        skb_pull(skb, lg);
 
                        /* Duplicate the Header */
                        skb_push(skbn, ROSE_MIN_LEN);
-                       memcpy(skbn->data, header, ROSE_MIN_LEN);
+                       skb_copy_to_linear_data(skbn, header, ROSE_MIN_LEN);
 
                        if (skb->len > 0)
                                skbn->data[2] |= M_BIT;
@@ -1234,7 +1266,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
                *asmptr = qbit;
        }
 
-       skb->h.raw = skb->data;
+       skb_reset_transport_header(skb);
        copied     = skb->len;
 
        if (copied > size) {
@@ -1278,7 +1310,8 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
        switch (cmd) {
        case TIOCOUTQ: {
                long amount;
-               amount = sk->sk_sndbuf - atomic_read(&sk->sk_wmem_alloc);
+
+               amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
                if (amount < 0)
                        amount = 0;
                return put_user(amount, (unsigned int __user *) argp);
@@ -1296,6 +1329,9 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
        case SIOCGSTAMP:
                return sock_get_timestamp(sk, (struct timeval __user *) argp);
 
+       case SIOCGSTAMPNS:
+               return sock_get_timestampns(sk, (struct timespec __user *) argp);
+
        case SIOCGIFADDR:
        case SIOCSIFADDR:
        case SIOCGIFDSTADDR:
@@ -1367,47 +1403,33 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 
 #ifdef CONFIG_PROC_FS
 static void *rose_info_start(struct seq_file *seq, loff_t *pos)
+       __acquires(rose_list_lock)
 {
-       int i;
-       struct sock *s;
-       struct hlist_node *node;
-
        spin_lock_bh(&rose_list_lock);
-       if (*pos == 0)
-               return SEQ_START_TOKEN;
-
-       i = 1;
-       sk_for_each(s, node, &rose_list) {
-               if (i == *pos)
-                       return s;
-               ++i;
-       }
-       return NULL;
+       return seq_hlist_start_head(&rose_list, *pos);
 }
 
 static void *rose_info_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-       ++*pos;
-
-       return (v == SEQ_START_TOKEN) ? sk_head(&rose_list)
-               : sk_next((struct sock *)v);
+       return seq_hlist_next(v, &rose_list, pos);
 }
 
 static void rose_info_stop(struct seq_file *seq, void *v)
+       __releases(rose_list_lock)
 {
        spin_unlock_bh(&rose_list_lock);
 }
 
 static int rose_info_show(struct seq_file *seq, void *v)
 {
-       char buf[11];
+       char buf[11], rsbuf[11];
 
        if (v == SEQ_START_TOKEN)
                seq_puts(seq,
                         "dest_addr  dest_call src_addr   src_call  dev   lci neigh st vs vr va   t  t1  t2  t3  hb    idle Snd-Q Rcv-Q inode\n");
 
        else {
-               struct sock *s = v;
+               struct sock *s = sk_entry(v);
                struct rose_sock *rose = rose_sk(s);
                const char *devname, *callsign;
                const struct net_device *dev = rose->device;
@@ -1418,8 +1440,8 @@ static int rose_info_show(struct seq_file *seq, void *v)
                        devname = dev->name;
 
                seq_printf(seq, "%-10s %-9s ",
-                       rose2asc(&rose->dest_addr),
-                       ax2asc(buf, &rose->dest_call));
+                          rose2asc(rsbuf, &rose->dest_addr),
+                          ax2asc(buf, &rose->dest_call));
 
                if (ax25cmp(&rose->source_call, &null_ax25_address) == 0)
                        callsign = "??????-?";
@@ -1428,7 +1450,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
 
                seq_printf(seq,
                           "%-10s %-9s %-5s %3.3X %05d  %d  %d  %d  %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n",
-                       rose2asc(&rose->source_addr),
+                       rose2asc(rsbuf, &rose->source_addr),
                        callsign,
                        devname,
                        rose->lci & 0x0FFF,
@@ -1444,15 +1466,15 @@ static int rose_info_show(struct seq_file *seq, void *v)
                        rose->hb / HZ,
                        ax25_display_timer(&rose->idletimer) / (60 * HZ),
                        rose->idle / (60 * HZ),
-                       atomic_read(&s->sk_wmem_alloc),
-                       atomic_read(&s->sk_rmem_alloc),
+                       sk_wmem_alloc_get(s),
+                       sk_rmem_alloc_get(s),
                        s->sk_socket ? SOCK_INODE(s->sk_socket)->i_ino : 0L);
        }
 
        return 0;
 }
 
-static struct seq_operations rose_info_seqops = {
+static const struct seq_operations rose_info_seqops = {
        .start = rose_info_start,
        .next = rose_info_next,
        .stop = rose_info_stop,
@@ -1473,13 +1495,13 @@ static const struct file_operations rose_info_fops = {
 };
 #endif /* CONFIG_PROC_FS */
 
-static struct net_proto_family rose_family_ops = {
+static const struct net_proto_family rose_family_ops = {
        .family         =       PF_ROSE,
        .create         =       rose_create,
        .owner          =       THIS_MODULE,
 };
 
-static struct proto_ops rose_proto_ops = {
+static const struct proto_ops rose_proto_ops = {
        .family         =       PF_ROSE,
        .owner          =       THIS_MODULE,
        .release        =       rose_release,
@@ -1544,8 +1566,7 @@ static int __init rose_proto_init(void)
                char name[IFNAMSIZ];
 
                sprintf(name, "rose%d", i);
-               dev = alloc_netdev(sizeof(struct net_device_stats),
-                                  name, rose_setup);
+               dev = alloc_netdev(0, name, rose_setup);
                if (!dev) {
                        printk(KERN_ERR "ROSE: rose_proto_init - unable to allocate memory\n");
                        rc = -ENOMEM;
@@ -1557,7 +1578,7 @@ static int __init rose_proto_init(void)
                        free_netdev(dev);
                        goto fail;
                }
-               lockdep_set_class(&dev->_xmit_lock, &rose_netdev_xmit_lock_key);
+               rose_set_lockdep_key(dev);
                dev_rose[i] = dev;
        }
 
@@ -1574,10 +1595,10 @@ static int __init rose_proto_init(void)
 
        rose_add_loopback_neigh();
 
-       proc_net_fops_create("rose", S_IRUGO, &rose_info_fops);
-       proc_net_fops_create("rose_neigh", S_IRUGO, &rose_neigh_fops);
-       proc_net_fops_create("rose_nodes", S_IRUGO, &rose_nodes_fops);
-       proc_net_fops_create("rose_routes", S_IRUGO, &rose_routes_fops);
+       proc_net_fops_create(&init_net, "rose", S_IRUGO, &rose_info_fops);
+       proc_net_fops_create(&init_net, "rose_neigh", S_IRUGO, &rose_neigh_fops);
+       proc_net_fops_create(&init_net, "rose_nodes", S_IRUGO, &rose_nodes_fops);
+       proc_net_fops_create(&init_net, "rose_routes", S_IRUGO, &rose_routes_fops);
 out:
        return rc;
 fail:
@@ -1604,10 +1625,10 @@ static void __exit rose_exit(void)
 {
        int i;
 
-       proc_net_remove("rose");
-       proc_net_remove("rose_neigh");
-       proc_net_remove("rose_nodes");
-       proc_net_remove("rose_routes");
+       proc_net_remove(&init_net, "rose");
+       proc_net_remove(&init_net, "rose_neigh");
+       proc_net_remove(&init_net, "rose_nodes");
+       proc_net_remove(&init_net, "rose_routes");
        rose_loopback_clear();
 
        rose_rt_free();