netdev - Re: [RFC] Add netdev all_adj_list refcnt propagation to fix panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <56FC37EC.7020404@cradlepoint.com>
Date:	Wed, 30 Mar 2016 14:32:44 -0600
From:	Andrew Collins <acollins@...dlepoint.com>
To:	David Miller <davem@...emloft.net>
CC:	<netdev@...r.kernel.org>, <mschiffer@...verse-factory.net>,
	<vfalico@...hat.com>, <vfalico@...il.com>
Subject: Re: [RFC] Add netdev all_adj_list refcnt propagation to fix panic

> From: Andrew Collins <acollins@...dlepoint.com>
> Date: Tue, 29 Mar 2016 11:25:03 -0600
>
>> This is an RFC patch to fix a relatively easily reproducible kernel
>> panic related to the all_adj_list handling for netdevs in recent kernels.
>>
>> This is more to generate discussion than anything else.  I don't
>> particularly like this approach, I'm hoping someone has a better idea.
>>
>> The following sequence of commands will reproduce the issue:
>>
>> ip link add link eth0 name eth0.100 type vlan id 100
>> ip link add link eth0 name eth0.200 type vlan id 200
>> ip link add name testbr type bridge
>> ip link set eth0.100 master testbr
>> ip link set eth0.200 master testbr
>> ip link add link testbr mac0 type macvlan
>> ip link delete dev testbr
>>
>> This creates an upper/lower tree of (excuse the poor ASCII art):
>>
>>              /---eth0.100-eth0
>> mac0-testbr-
>>              \---eth0.200-eth0
>>
>> When testbr is deleted, the all_adj_lists are walked, and eth0 is deleted twice from
>> the mac0 list. Unfortunately, during setup in __netdev_upper_dev_link, only one
>> reference to eth0 is added, so this results in a panic.
>>
>> This change adds reference count propagation so things are handled properly.
>>
>> Matthias Schiffer reported a similar crash in batman-adv:
>>
>> https://github.com/freifunk-gluon/gluon/issues/680
>> https://www.open-mesh.org/issues/247
>>
>> which this patch also seems to resolve.
>
> Veaceslav, please look into this.
>
> Thanks.
>
> !SIG:56fc30b5184771297483788!
>

+vfalico's new address picked up from git logs