netdev - Re: [PATCH] ip6_gre: don't allow to remove the fb_tunnel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20140415.145640.1885112149584382325.davem@davemloft.net>
Date:	Tue, 15 Apr 2014 14:56:40 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	nicolas.dichtel@...nd.com
Cc:	netdev@...r.kernel.org, xeb@...l.ru
Subject: Re: [PATCH] ip6_gre: don't allow to remove the fb_tunnel_dev

From: Nicolas Dichtel <nicolas.dichtel@...nd.com>
Date: Tue, 15 Apr 2014 09:57:28 +0200

> Le 15/04/2014 06:04, David Miller a écrit :
>> From: Nicolas Dichtel <nicolas.dichtel@...nd.com>
>> Date: Mon, 14 Apr 2014 17:11:38 +0200
>>
>>> It's possible to remove the FB tunnel with the command 'ip link del
>>> ip6gre0' but
>>> this is unsafe, the module always supposes that this device
>>> exists. For example,
>>> ip6gre_tunnel_lookup() may use it unconditionally.
>>>
>>> Let's add a rtnl handler for dellink, which will never remove the FB
>>> tunnel (we
>>> let ip6gre_destroy_tunnels() do the job).
>>>
>>> Introduced by commit c12b395a4664 ("gre: Support GRE over IPv6").
>>>
>>> CC: Dmitry Kozlov <xeb@...l.ru>
>>> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@...nd.com>
>>
>> I don't see how we ever get rid of fb_tunnel_dev and can therefore
>> remove the module successfully.
>>
>> It is created by the per-netns initialization, but since it isn't
>> added to the hashes I don't see how the per-netns exit code can
>> end up unregistering and freeing it up.
>>
>> How is this supposed to work?
> It is added to the hashes in ip6gre_init_net() in bucket [0][0]:
> #define tunnels_wc      tunnels[0]
> [snip]
>         rcu_assign_pointer(ign->tunnels_wc[0],
>                            netdev_priv(ign->fb_tunnel_dev));
> 
> Thus the tunnel is deleted by the loop in ip6gre_destroy_tunnels().

Thanks for explaining, I missed that bit.  Applied and queued up for -stable,
thanks!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html