netdev - Re: [PATCH net] ip6_gre: fix tunnel list corruption for x-netns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20190115.134518.2237971437325529794.davem@davemloft.net>
Date:   Tue, 15 Jan 2019 13:45:18 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     olivier.matz@...nd.com
Cc:     netdev@...r.kernel.org, petrm@...lanox.com
Subject: Re: [PATCH net] ip6_gre: fix tunnel list corruption for x-netns

From: Olivier Matz <olivier.matz@...nd.com>
Date: Wed,  9 Jan 2019 10:57:21 +0100

> In changelink ops, the ip6gre_net pointer is retrieved from
> dev_net(dev), which is wrong in case of x-netns. Thus, the tunnel is not
> unlinked from its current list and is relinked into another net
> namespace. This corrupts the tunnel lists and can later trigger a kernel
> oops.
> 
> Fix this by retrieving the netns from device private area.
> 
> Fixes: c8632fc30bb0 ("net: ip6_gre: Split up ip6gre_changelink()")
> Cc: Petr Machata <petrm@...lanox.com>
> Signed-off-by: Olivier Matz <olivier.matz@...nd.com>
> Acked-by: Nicolas Dichtel <nicolas.dichtel@...nd.com>

Good catch, applied and queued up for -stable.