netdev - Re: [PATCH] net_namespace: fixed net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 8 Sep 2016 16:16:04 -0700
From:   Jojy Varghese <jojy.varghese@...il.com>
To:     Eric Dumazet <eric.dumazet@...il.com>
Cc:     netdev@...r.kernel.org, davem@...emloft.net
Subject: Re: [PATCH] net_namespace: fixed net_device reference leak

The dst's do disappear but the net device does not. A better solution
is to only hold reference to dst's net device ONLY if it is not a
loopback device. In the case of the loopback device, we want to do
only a "put" on it and skip the "hold".

Updating the patch below:

---
 net/core/dst.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/net/core/dst.c b/net/core/dst.c
index 7e45593..f63027e 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -433,12 +433,11 @@ static void dst_ifdown(struct dst_entry *dst,
struct net_device *dev,
                dst->input = dst_discard;
                dst->output = dst_discard_out;
        } else {
-               if (dst->dev == dev_net(dst->dev)->loopback_dev)
-                       dst->dev = init_net.loopback_dev;
-               else
+               if (dst->dev != dev_net(dst->dev)->loopback_dev) {
                        dst->dev = dev_net(dst->dev)->loopback_dev;
+                       dev_hold(dst->dev);
+               }

-               dev_hold(dst->dev);
                dev_put(dev);
        }
 }
--
1.8.3.1



On Thu, Sep 8, 2016 at 3:16 PM, Eric Dumazet <eric.dumazet@...il.com> wrote:
> On Thu, 2016-09-08 at 15:12 -0700, Jojy Varghese wrote:
>> Hi Eric/Lance
>>
>>  Thanks for taking time to look at the patch. The problem in dst.c's
>> "dst_ifdown" is that it will never do an actual "dev_put" on the
>> loopback net device. This results in the loopback net device to be
>> alive even when the dst goes away.
>
> Sure, but the dst themselves should disappear, and thus release their
> dst->dev reference.
>
> Something is missing.
>
> loopback device is only used when we remove one device from the system,
> but namespace (and loopback device) is still around.
>
>
>



-- 
Jojy G Varghese