linux-kernel - Re: [PATCH] net: Avoid calling WARN_ON() on -ENOMEM in __dev_change_net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250331121707.5fcc75e026c2f3d0233abcd5@mt-integration.ru>
Date: Mon, 31 Mar 2025 12:17:07 +0300
From: Ivan Abramov <i.abramov@...integration.ru>
To: "Eric W. Biederman" <ebiederm@...ssion.com>
CC: Kuniyuki Iwashima <kuniyu@...zon.com>, <aleksander.lobakin@...el.com>,
	<davem@...emloft.net>, <edumazet@...gle.com>, <horms@...nel.org>,
	<jdamato@...tly.com>, <kuba@...nel.org>, <leitao@...ian.org>,
	<linux-kernel@...r.kernel.org>, <lvc-project@...uxtesting.org>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>,
	<syzbot+1df6ffa7a6274ae264db@...kaller.appspotmail.com>
Subject: Re: [PATCH] net: Avoid calling WARN_ON() on -ENOMEM in
 __dev_change_net_namespace()

On Fri, 28 Mar 2025 09:17:42 -0500, Eric W. Biederman wrote:
> Kuniyuki Iwashima <kuniyu@...zon.com> writes:

>>> Subject: [PATCH] net: Avoid calling WARN_ON() on -ENOMEM in __dev_change_net_namespace()
>>
>> s/__dev_change_net_namespace/netif_change_net_namespace/
>>
>> Also, please specify the target tree: [PATCH v2 net]
>>
>>
>> From: Ivan Abramov <i.abramov@...integration.ru>
>> Date: Fri, 28 Mar 2025 04:12:57 +0300
>>> It's pointless to call WARN_ON() in case of an allocation failure in
>>> device_rename(), since it only leads to useless splats caused by deliberate
>>> fault injections, so avoid it.

> No.  It is not pointless.  The WARN_ON is there because the code can not
> rollback if device_rename fails in
> __dev_change_net_namespace/netif_change_net_namespace.

It's pointless in the sense that failure to allocate a few hundred bytes is
practically impossible and can only happen due to deliberate fault
injection during testing/fuzzing. The proposition is to avoid just that,
not to remove WARN_ON() altogether.

> If device_rename fails it means that the kernel's device tree
> are inconsistent with the actual network devices.

> If anything we need a way to guarantee that the device_rename will
> succeed, so that all of the parts that may fail may be performed
> before we commit ourselves by notifying userspace that the device
> is being renamed.
 
> As for Breno Leitao <leitao@...ian.org>'s question should we fail
> immediately.  That will put us in a far worse state.

> As I recall the WARN_ON exists there because someone at the last minute
> stuffed network devices into sysfs, and no one has taken the time to
> handle the practically impossible case of a device_rename failure.

> If you are going to do something with this logic please figure out how
> to handle a failure instead just shutting up the error message that
> let's you know something bad is wrong in the kernel.

Although the issue of properly handling failure of device_rename deserves
a good thought and another patch/series, it's a much bigger problem to
solve, compared to what I try to achieve here.

> Eric

Thank you for detailed response! 

-- 
Ivan Abramov <i.abramov@...integration.ru>