netdev - [PATCH 0/3] dev: Fix network device ifindex allocation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 16 Jun 2017 17:23:50 +0300
From:   Serhey Popovych <serhe.popovych@...il.com>
To:     netdev@...r.kernel.org
Subject: [PATCH 0/3] dev: Fix network device ifindex allocation

There are some problems with network device ifindex handling in
the core and veth driver.

* Network device index (ifindex) is signed int, but only values > 0
  consodered to be valid. However it is possible for userspace
  to supply negative ifindex value using following command:

    # ip link add dev dummy2 index -100 up type dummy
    # ip link sh dev dummy2
    Device "dummy2" does not exist.
    # ip li sh |tail -n2
    -100: dummy2: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue \
    state UNKNOWN mode DEFAULT group default
        link/ether 7e:77:1b:49:50:de brd ff:ff:ff:ff:ff:ff

* It is possible to hit infinite loop when number of ifindex in
  some network namespace get exchausted.

	# There should be plenty of RAM to create INT_MAX netdev.
	# Hitting OOM is much likely with such huge number, but anyway.
	for ((i = 1; i <= 0x7fffffff; i++)); do
		ifname="dummy$i";
		[ ! -d "/sys/class/net/$ifname" ] || continue
		ip link add dev "$ifname" index "$i" type dummy
	done

* (minor) check for dev->ifindex being greater than zero.

Patches in this series tries to address these problems.

Serhey Popovych (3):
  dev: Prevent creating network devices with negative ifindex
  dev: Avoid infinite loop on network device index exhaustion
  veth: Set ifindex only if given and not negative

 drivers/net/veth.c |  2 +-
 net/core/dev.c     | 30 ++++++++++++++++++++++--------
 2 files changed, 23 insertions(+), 9 deletions(-)

-- 
1.8.3.1