linux-kernel - Re: [PATCH v2 1/2] nfs: don't share pNFS DS connections between net namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1587C44B-7BDE-4B36-8CE6-C654CB154228@redhat.com>
Date: Fri, 11 Apr 2025 09:57:13 -0400
From: Benjamin Coddington <bcodding@...hat.com>
To: Jeff Layton <jlayton@...nel.org>
Cc: Trond Myklebust <trondmy@...nel.org>, Anna Schumaker <anna@...nel.org>,
 Omar Sandoval <osandov@...ndov.com>, Sargun Dillon <sargun@...gun.me>,
 linux-nfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 1/2] nfs: don't share pNFS DS connections between net
 namespaces

On 10 Apr 2025, at 16:42, Jeff Layton wrote:

> Currently, different NFS clients can share the same DS connections, even
> when they are in different net namespaces. If a containerized client
> creates a DS connection, another container can find and use it. When the
> first client exits, the connection will which can lead to stalls in

                                         ^^ close ?

> other clients.
>
> Add a net namespace pointer to struct nfs4_pnfs_ds, and compare those
> value to the caller's netns in _data_server_lookup_locked() when
> searching for a nfs4_pnfs_ds to match.
>
> Reported-by: Omar Sandoval <osandov@...ndov.com>
> Reported-by: Sargun Dillon <sargun@...gun.me>
> Closes: https://lore.kernel.org/linux-nfs/Z_ArpQC_vREh_hEA@telecaster/
> Tested-by: Sargun Dillon <sargun@...gun.me>
> Signed-off-by: Jeff Layton <jlayton@...nel.org>

Looks good to me,

Reviewed-by: Benjamin Coddington <bcodding@...hat.com>

Ben