netdev - Re: [PATCH net v2 01/11] net: core: limit nested device depth

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 12 Sep 2019 19:14:37 +0900
From:   Taehee Yoo <ap420073@...il.com>
To:     David Miller <davem@...emloft.net>
Cc:     Netdev <netdev@...r.kernel.org>, j.vosburgh@...il.com,
        vfalico@...il.com, Andy Gospodarek <andy@...yhouse.net>,
        Jiří Pírko <jiri@...nulli.us>,
        sd@...asysnail.net, Roopa Prabhu <roopa@...ulusnetworks.com>,
        saeedm@...lanox.com, manishc@...vell.com, rahulv@...vell.com,
        kys@...rosoft.com, haiyangz@...rosoft.com, sthemmin@...rosoft.com,
        sashal@...nel.org, hare@...e.de, varun@...lsio.com,
        ubraun@...ux.ibm.com, kgraul@...ux.ibm.com,
        Jay Vosburgh <jay.vosburgh@...onical.com>
Subject: Re: [PATCH net v2 01/11] net: core: limit nested device depth

On Thu, 12 Sep 2019 at 18:38, David Miller <davem@...emloft.net> wrote:
>
> From: Taehee Yoo <ap420073@...il.com>
> Date: Thu, 12 Sep 2019 12:56:19 +0900
>
> > I tested with this reproducer commands without lockdep.
> >
> >     ip link add dummy0 type dummy
> >     ip link add link dummy0 name vlan1 type vlan id 1
> >     ip link set vlan1 up
> >
> >     for i in {2..200}
> >     do
> >             let A=$i-1
> >
> >             ip link add name vlan$i link vlan$A type vlan id $i
> >     done
> >     ip link del vlan1 <-- this command is added.
>
> Is there any other device type which allows arbitrary nesting depth
> in this manner other than VLAN?  Perhaps it is the VLAN nesting
> depth that we should limit instead of all of this extra code.

Below device types have the same problem.
VLAN, BONDING, TEAM, VXLAN, MACVLAN, and MACSEC.
All the below test commands reproduce a panic.

BONDING test commands:
    ip link add bond0 type bond
    for i in {1..200}
    do
            let A=$i-1
            ip link add bond$i type bond
            ip link set bond$i master bond$A
    done
    ip link set bond5 master bond0

TEAM test commands:
    ip link add team0 type team
    for i in {1..200}
    do
            let A=$i-1
            ip link add team$i type team
            ip link set team$i master team$A
    done

MACSEC test commands:
    ip link add link lo macsec0 type macsec
    for i in {1..100}
    do
            let A=$i-1
            ip link add link macsec$A macsec$i type macsec
    done
    ip link del macsec0

MACVLAN test commands:
    ip link add dummy0 type dummy
    ip link add macvlan1 link dummy0 type macvlan
    ip link add vlan2 link macvlan1 type vlan id 2
    let i=3
    for j in {1..100}
    do
            let A=$i-1
            ip link add macvlan$i link vlan$A type macvlan
            let i=$i+1
            let A=$i-1
            ip link add vlan$i link macvlan$A type vlan id $i
            let i=$i+1
    done
    ip link del dummy0

VXLAN test commands:
    ip link add vxlan1 type vxlan dev lo id 1 dstport 1
    for i in {2..100}
    do
            let A=$i-1
            ip link add vxlan$i type vxlan dev vxlan$A id $i dstport $i
    done
    ip link del vxlan1