netdev - Re: [Patch net-next 2/2] netns: avoid disabling irq for netns id

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpU8XPixg3g=NPbOcUPDu+o1bOccpnng=HrW8-VzY-xmgw@mail.gmail.com>
Date:   Wed, 19 Oct 2016 13:07:00 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Elad Raz <e@...draz.com>
Cc:     Nicolas Dichtel <nicolas.dichtel@...nd.com>,
        David Miller <davem@...emloft.net>,
        Linux Netdev List <netdev@...r.kernel.org>,
        Jiri Pirko <jiri@...nulli.us>,
        Ido Schimmel <idosch@...lanox.com>,
        Yotam Gigi <yotamg@...lanox.com>
Subject: Re: [Patch net-next 2/2] netns: avoid disabling irq for netns id

On Wed, Oct 19, 2016 at 8:21 AM, Elad Raz <e@...draz.com> wrote:
> On Fri, Sep 2, 2016 at 11:12 AM, Nicolas Dichtel
> <nicolas.dichtel@...nd.com> wrote:
>> Le 02/09/2016 à 06:53, Cong Wang a écrit :
>>> We never read or change netns id in hardirq context,
>>> the only place we read netns id in softirq context
>>> is in vxlan_xmit(). So, it should be enough to just
>>> disable BH.
>>
>> Are you sure? Did you audit all part of the code?
>> peernet2id() is called from netlink core system (do_one_broadcast()). Are you
>> sure that no driver call this function from an hard irq context?
>>
>> I think that NETLINK_LISTEN_ALL_NSID is largely untested, so it will be hard to
>> detect a bug introduced in this feature.
>
> I'm seeing strange things on our systems on boot time when trying to
> mount autofs.
> I bisected and got this patch as the bad one.
> I can see that only when I'm using "debug" config file.

Yeah, I saw the same report from SELinux developers, I am working
on a fix.

Thanks.