netdev - virtio_net: doesn't free last skb in tx buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed, 22 Jan 2014 15:02:20 +0100
From:	Daniel Andersson Tenninge <daniel.andersson.tenninge@...csson.com>
To:	<netdev@...r.kernel.org>
CC:	Rusty Russell <rusty@...tcorp.com.au>,
	"Michael S. Tsirkin" <mst@...hat.com>,
	Patrick McHardy <kaber@...sh.net>,
	UABFRA <anders.franzen@...csson.com>
Subject: virtio_net: doesn't free last skb in tx buffer

Hi,

I have been chasing a fault when closing a network namespace with a soft 
device in (vlan, macvlan, ...) and the "real" device is a virtio device. 
I couldn't decide if I should email the netdev or virtualization list 
but I hope it is sent right.

The problem is that the namespace can never close because there is a 
neighbour entry holding a reference to the device. This neighbour entry 
is not free:d since a dst_entry is left with a reference to it and this 
dst_entry is referenced from the last sk_buff sent on the virtio device.

 From the code it looks like whenever a sk_buff should be sent in the 
start_xmit (driver/net/virtio_net.c) function the driver checks the tx 
ring buffer if there are any old sk_buff there that should be free:d. 
When the network namespace is closed down the last sk_buff cannot be 
free:d until another is sent and if this doesn't happen the namespace 
will hang forever.

Now this could be done in the net_device_ops ndo_uninit, but it seems 
like if the there is a device on top of the virtio device, e.g. a vlan 
device, the ndo_uninit is called for the vlan but the vlan never passes 
it down to the real_dev. The same can be seen in the macvlan driver as 
well. Is it made like this intentional and in that case what is the 
preferred way for a device driver to clean up stuff during network 
namespace shutdown?

Wouldn't this cause a more generic problem for network device drivers 
that expect to be able to clean up stuff in ndo_uninit or is this not 
meant to be used for this and the problem is specific to the virtio_net 
leaving data after start_xmit returns?

BR,
--Daniel

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html